870 matches found
Milesight UR32L zebra vlan_name OS command injection vulnerabilities
Talos Vulnerability Report TALOS-2023-1723 Milesight UR32L zebra vlanname OS command injection vulnerabilities July 6, 2023 CVE Number CVE-2023-25582,CVE-2023-25583 SUMMARY Two OS command injection vulnerabilities exist in the zebra vlanname functionality of Milesight UR32L v32.3.0.5. A specially...
PT-2023-18408 · Milesight · Milesight Ur32L
Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: A command injection issue exists in the vtysh ubus get fw logs functionality. This can be triggered by a specially crafted network request, potentially leading to command execution. Recommendation...
CVE-2023-23571: Buffer Over-read
An access violation vulnerability exists in the eventcore functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to denial of service. An attacker can send a network request to trigger this vulnerability...
CVE-2023-23902: Stack-based Buffer Overflow
A buffer overflow vulnerability exists in the uhttpd login functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to remote code execution. An attacker can send a network request to trigger this vulnerability...
CVE-2023-22844: Use of Hard-coded Cryptographic Key
An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a network request to trigger this vulnerability...
CVE-2023-23547: Improper Limitation of a Pathname to a Restricted Directory
A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary file read. An attacker can send a network request to trigger this vulnerability...
CVE-2023-24520: Improper Neutralization of Special Elements used in a Command
Two OS command injection vulnerability exist in the vtyshubus toolshexcute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is i...
CVE-2023-22319: Improper Neutralization of Special Elements used in an SQL Command
A sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a malicious packet to trigger this vulnerability...
CVE-2023-25583: Improper Neutralization of Special Elements used in an OS Command
Two OS command injection vulnerabilities exist in the zebra vlanname functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch...
CVE-2023-22299: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in the vtyshubus getfwlogs functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability...
CVE-2023-25582: Improper Neutralization of Special Elements used in an OS Command
Two OS command injection vulnerabilities exist in the zebra vlanname functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch...
PT-2023-19690 · Milesight · Milesight Ur32L
Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: The issue is related to OS command injection vulnerabilities in the urvpn client cmd name action functionality. A specially crafted network request can lead to arbitrary command execution. An...
Diagon input validation vulnerability
Diagon is an interactive interpreter from the individual developer Arthur Sonzogni in France. An input validation error vulnerability exists in Diagon version v1.0.139, which stems from the presence of an access conflict vulnerability, where a specially crafted network request could result in a...
Diagonal buffer error vulnerability
Diagon is an interactive interpreter from the individual developer Arthur Sonzogni in France. A buffer error vulnerability exists in Diagon version v1.0.139, which stems from the presence of a heap-based buffer overflow vulnerability that can be triggered by an attacker sending a network request...
PT-2023-6163 · Yifan · Yifan Yf325
Name of the Vulnerable Software and Affected Versions: Yifan YF325 version 1.0 20221108 Description: Two heap-based buffer overflow vulnerabilities exist in the gwcfg cgi set manage post data functionality. A specially crafted network request can lead to a heap buffer overflow. An attacker can se...
CVE-2023-23599
When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird 102.7...
Design/Logic Flaw
When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox 109, Thunderbird 102.7, and Firefox ESR 102.7...
Mozilla Firefox security vulnerabilities
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 110, which originates after downloading a Windows. url shortcut from the local file system, an attacker could provide a remote path...
CVE-2023-23599
When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird 102.7...
