2802 matches found
Adobe: Main Domain Takeover at https://www.marketo.net/
Resolved valid subdomain takeover report on Marketo. We appreciate the collaboration with the researcher...
Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks
Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...
CVE-2022-37450
Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...
Design/Logic Flaw
Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...
Cross-site Scripting (XSS)
jspwiki-main is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of sanitization in the startDay attribute in the execute function of WeblogPlugin.java, allowing an attacker to inject and execute malicious javascript through the maliciously crafted WeblogPlugin...
org.apache.jspwiki.it:jspwiki-selenide-tests (>=2.11.0 <=2.11.2), org.apache.jspwiki:jspwiki-210-adapters (>=2.11.0 <=2.11.2) +5 more potentially affected by CVE-2022-34158 via org.apache.jspwiki:jspwiki-main (>=2.11.0 <=2.11.2)
org.apache.jspwiki:jspwiki-main MAVEN version =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.2 Source cves: CVE-2022-34158 Source advisory: OSV:GHSA-JP3M-P26H-MM7V...
org.apache.jspwiki.it:jspwiki-selenide-tests (>=2.11.0 <=2.11.2), org.apache.jspwiki:jspwiki-210-adapters (>=2.11.0 <=2.11.2) +5 more potentially affected by CVE-2022-27166 +1 more via org.apache.jspwiki:jspwiki-main (>=2.11.0 <=2.11.2)
org.apache.jspwiki:jspwiki-main MAVEN version =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.2 Source cves: CVE-2022-27166, CVE-2022-28732 Source advisory: OSV:GHSA-2FXF-QJ94-3F83...
org.apache.jspwiki.it:jspwiki-selenide-tests (>=2.11.0 <=2.11.2), org.apache.jspwiki:jspwiki-210-adapters (>=2.11.0 <=2.11.2) +5 more potentially affected by CVE-2022-28732 via org.apache.jspwiki:jspwiki-main (>=2.11.0 <=2.11.2)
org.apache.jspwiki:jspwiki-main MAVEN version =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.2 Source cves: CVE-2022-28732 Source advisory: OSV:GHSA-HPH8-29XW-QFXX...
org.apache.jspwiki.it:jspwiki-selenide-tests (>=2.11.0 <=2.11.2), org.apache.jspwiki:jspwiki-210-adapters (>=2.11.0 <=2.11.2) +5 more potentially affected by CVE-2022-28730 +1 more via org.apache.jspwiki:jspwiki-main (>=2.11.0 <=2.11.2)
org.apache.jspwiki:jspwiki-main MAVEN version =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.2 Source cves: CVE-2022-28730, CVE-2022-28732 Source advisory: OSV:GHSA-GGJQ-8C4C-68R5...
PT-2022-24009 · Unknown · Go-Ethereum
Name of the Vulnerable Software and Affected Versions: Go Ethereum aka geth versions 1.10.21 and earlier Description: The issue allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain...
CVE-2022-35619
D-LINK DIR-818LW A1:DIR818LFW105b01 was discovered to contain a remote code execution RCE vulnerability via the function ssdpcgimain...
CVE-2022-35619
D-LINK DIR-818LW A1:DIR818LFW105b01 was discovered to contain a remote code execution RCE vulnerability via the function ssdpcgimain...
get-npm-package-version Command Injection vulnerability
The package get-npm-package-version before 1.0.7 is vulnerable to Command Injection via the main function in index.js...
PT-2022-4530 · D Link · D-Link Dir-818Lw
Name of the Vulnerable Software and Affected Versions: D-LINK DIR-818LW version DIR818L FW105b01 Description: The issue is related to a remote code execution vulnerability via the ssdpcgi main function. This vulnerability is associated with coding errors in the firmware of D-LINK DIR-818LW router...
The vulnerability of the “Main” function in the microprogramming software of the TOTOLink A950RG allows a intruder to execute arbitrary commands.
The vulnerability of the “Main” function in the TOTOLink A950RG microcontroller software is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands through the QUERYSTRING parameter...
get-npm-package-version 命令注入漏洞
get-npm-package-version is a package for hoperyy individual developers. It is used to get the npm package version. A command injection vulnerability exists in get-npm-package-version before 1.0.7, which is caused by command injection via the main function in index.js...
PT-2022-9062 · Unknown · Get-Npm-Package-Version
Name of the Vulnerable Software and Affected Versions: get-npm-package-version versions prior to 1.0.7 Description: The issue concerns Command Injection via the main function in index.js. Recommendations: For versions prior to 1.0.7, update to version 1.0.7 or later to resolve the issue. As a...
The vulnerability of the “Main” function in the microprogramming software of the TOTOLink A3600R router allows a intruder to execute arbitrary commands.
The vulnerability of the “Main” function in the microprogramming software for the TOTOLink A3600R router lies in the lack of measures to sanitize input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the QUERYSTRING parameter...
The vulnerability of the “Main” function in the TOTOLink A860R microcontroller software allows a intruder to execute any command they desire.
The vulnerability of the “Main” function in the TOTOLink A860R microcontroller software is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands through the QUERYSTRING parameter...