14065 matches found
Design/Logic Flaw
An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts...
Arbitrary file deletion
An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts...
CVE-2021-46418
Telesquare TLR-2855KS6 is affected by CVE-2021-46418. The Nuclei template documents an unauthenticated vulnerability where an HTTP PUT request can create arbitrary files, including CGI scripts, on the device. Impact is described as potentially enabling remote code execution via file creation. Aff...
CVE-2021-46418
An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts...
GHSA-FWR7-V2MV-HH25 Prototype Pollution in async
A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x fixed in 3.2.2 and 2.6.4, which could let a malicious user obtain privileges via the mapValues method...
Prototype Pollution in async
A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x fixed in 3.2.2 and 2.6.4, which could let a malicious user obtain privileges via the mapValues method...
CVE-2021-46419: Undefined Security Weakness
An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts...
CVE-2021-46418: Undefined Security Weakness
An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts...
PT-2022-12694
Name of the Vulnerable Software and Affected Versions Telesquare TLR-2855KS6 affected versions not specified Description The issue concerns an unauthorized file creation vulnerability. It affects Telesquare TLR-2855KS6 via the PUT method, allowing the creation of CGI scripts. Recommendations At t...
PT-2022-12695
Name of the Vulnerable Software and Affected Versions Telesquare TLR-2855KS6 affected versions not specified Description The issue concerns an unauthorized file deletion vulnerability. It affects Telesquare TLR-2855KS6, allowing the deletion of system files and scripts via the DELETE method...
mintBorrowTicketTo can be a contract with no onERC721Received method, which may cause the BorrowTicket NFT to be frozen and put users' funds at risk
Lines of code Vulnerability details IERC721MintableborrowTicketContract.mintmintBorrowTicketTo, id; function mintaddress to, uint256 tokenId external override loanFacilitatorOnly mintto, tokenId; If mintBorrowTicketTo is a contract that does not implement the onERC721Received method, in the curre...
Telesquare TLR-2855KS6 security vulnerability
The Telesquare TLR-2855KS6 is an LTE router from Telesquare Korea. A security vulnerability exists in the Telesquare TLR-2855KS6, which stems from an unauthorized file deletion vulnerability that could allow system files and scripts to be deleted via the DELETE method...
Telesquare TLR-2855KS6 security vulnerability
The Telesquare TLR-2855KS6 is an LTE router from Telesquare Korea. A security vulnerability exists in the Telesquare TLR-2855KS6 that stems from an unauthorized file creation vulnerability via the PUT method that could allow the creation of CGI scripts...
CVE-2021-43138
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues method, aka lib/internal/iterator.js createObjectIterator prototype pollution...
CVE-2021-43138
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues method, aka lib/internal/iterator.js createObjectIterator prototype pollution...
Design/Logic Flaw
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues method, aka lib/internal/iterator.js createObjectIterator prototype pollution...
Async security vulnerabilities
Async is a utility module from Caolan McMahon Personal Developer in the UK. It is intended for use with asynchronous JavaScript. A security vulnerability exists in Async 3.2.1 and earlier, which stems from the mapValues method. An attacker could gain privileges via the mapValues method...
CVE-2022-26110: Undefined Security Weakness
An issue was discovered in HTCondor 8.8.x before 8.8.16, 9.0.x before 9.0.10, and 9.1.x before 9.6.0. When a user authenticates to an HTCondor daemon via the CLAIMTOBE method, the user can then impersonate any entity when issuing additional commands to that daemon...
CVE-2021-43138
CVE-2021-43138 affects Async (lib/iterator.js) where mapValues() enables prototype pollution via createObjectIterator, allowing a malicious user to obtain privileges. Affected: Async before 2.6.4 and 3.x before 3.2.2. Root cause: prototype pollution in Object prototype through pollution of mapVal...