CVE-2022-34531

DedeCMS v5.7.95 was discovered to contain a remote code execution RCE vulnerability via the component mytag main.php...

Desdev DedeCMS 安全漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing, content management, content editing and content retrieval functions. A security vulnerability exists in...

The vulnerability of the “Main” function in the microprogramming software of the TOTOLink A810R router allows a intruder to execute arbitrary commands.

The vulnerability of the “Main” function in the microprogramming software for the TOTOLink A810R router is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands through the QUERYSTRING parameter...

The vulnerability of the “Main” function in the microprogramming software of the TOTOLink A800R router allows a intruder to execute arbitrary commands.

The vulnerability of the “Main” function in the microprogramming software for the TOTOLink A800R router is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands through the QUERYSTRING parameter...

The vulnerability of the “Main” function in the microprogramming software of the TOTOLink A830R router allows a intruder to execute arbitrary commands.

The vulnerability of the “Main” function in the TOTOLink A830R microcontroller-based router software is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands through the QUERYSTRING parameter...

The vulnerability of the Main function in the microprogrammed software of TOTOLink T10 allows a hacker to execute arbitrary commands.

The vulnerability of the Main function in the microprogrammed routing software TOTOLink T10 is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands through the QUERYSTRING parameter...

GHSA-V42Q-78W8-8FCC set-deep-prop Prototype Pollution

All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...

set-deep-prop Prototype Pollution

All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...

Internet Bug Bounty: Disabling context isolation, nodeIntegrationInSubFrames using an unauthorised frame.

Details can be found in the following github advisory: https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7 Impact Using a renderer exploit, context isolation and nodeIntegrationInSubFrames can be disabled, which enables an attacker to leak IPC module and communicate with...

PT-2022-6681 · FFmpeg +6 · Ffmpeg +6

Name of the Vulnerable Software and Affected Versions: FFmpeg affected versions not specified Description: A null pointer dereference issue was discovered in the decode main header function of the libavformat/nutdec.c file. The flaw occurs because the function lacks a check of the return value of...

Command Injection

codecov is vulnerable to command injection. The vulnerability exists due to the lack of sanitization in the gcov arguments in the main function of init.py, allowing an attacker to inject and execute malicious commands before being provided to the Popen functionality...

shk-main-spessart.de Cross Site Scripting vulnerability OBB-2688912

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-33007

TRENDnet Wi-Fi routers TEW751DR v1.03 and TEW-752DRU v1.03 were discovered to contain a stack overflow via the function genacgimain...

Malicious code in main.prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d49c9c22f69777b9b4a925ef9f7a26be11467cba5977a25557db82dc1541a5d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-native-wix-engine-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc7f90939e7d4d79c1891948c561a8f6a3bdac331ebbe2341985df25cf5cc295 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in voicemail-main-fsm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90ed83674650961e5a0e991ff16430ef0df969b6e843db3202f67a8c78bc9aee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-41415

Subscription-Manager v1.0 /main.js has a cross-site scripting XSS vulnerability in the machineDetail parameter...

Subscription-Manager 跨站脚本漏洞

Subscription-Manager is a subscription management system by the individual developer of China's JiYouRan youranreus. A cross-site scripting vulnerability exists in Subscription-Manager v1.0, which stems from a lack of filtering and escaping of the machineDetail parameter in /main.js...

Command Injection

Nuitka is vulnerable to command injection. The vulnerability exists in the main function of main.py, allowing an attacker with the privileges of the running program by setting NUITKAPYTHONPATH, NUITKANAMESPACES or NUITKAPTHIMPORTED to inject and execute malicious payload strings...

CVE-2022-26364

x86 pv: Insufficient care with non-coherent mappings This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to...