CVE-2022-40717

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the anweb service, which listens on TCP ports 80 and 443 by default. The issue...

CVE-2022-40719

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpdgeneric.lua plugin for the xupnpd service, which...

PT-2023-4836 · D Link · D-Link Dap-2622

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2622 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. The specific flaw exists within the DDP service, resulti...

CVE-2022-40719

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpdgeneric.lua plugin for the xupnpd service, which...

PT-2023-4733 · D Link · D-Link Dap-2622

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2622 affected versions not specified Description: The issue is related to a stack-based buffer overflow in the DDP service of the D-Link DAP-2622 router. This allows network-adjacent attackers to execute arbitrary code on affected...

PT-2023-4833 · D Link · D-Link Dap-2622

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2622 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. The specific flaw exists within the DDP service, resulti...

PT-2023-9108 · D Link · D-Link Dap-2622

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2622 affected versions not specified Description: The issue is related to a stack-based buffer overflow in the DDP service of the D-Link DAP-2622 wireless access point. This can be exploited by a remote attacker to execute arbitrar...

CVE-2022-43976

An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. Direct access to the API is possible on TCP port 8888 via programs located in the cgi-bin folder without any authentication...

PT-2023-14418 · Ge Grid Solutions · Fc46-Webbridge

Name of the Vulnerable Software and Affected Versions: FC46-WebBridge on GE Grid Solutions MS3000 devices versions prior to 3.7.6.25p0 3.2.2.17p0 4.7p0 Description: An issue was discovered that allows direct access to the API on TCP port 8888 via programs located in the cgi-bin folder without any...

PT-2023-2019 · Tp Link · Tp-Link Archer Ax21

Name of the Vulnerable Software and Affected Versions: TP-Link Archer AX21 affected versions not specified Description: The issue is caused by a buffer overflow in the tdpServer microprogram of TP-Link Archer AX21 routers. This allows a remote attacker to execute arbitrary code on affected...

CVE-2022-38355

Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to the local area network LAN to disclose sensitive information stored by the affected product without requiring authentication...

VulnCheck KEV: CVE-2021-46422

Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication...

PT-2022-6574 · NetGear · Netgear Rax30

Name of the Vulnerable Software and Affected Versions: NETGEAR RAX30 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations. The flaw exists within the configuration of the lighttpd HTTP server, resulting from...

PT-2022-27692 · Kubeview · Kubeview

Name of the Vulnerable Software and Affected Versions: KubeView versions 0.1.31 and earlier Description: The issue allows attackers to obtain control of a Kubernetes cluster because the api/scrape/kube-system endpoint does not require authentication, and it retrieves certificate files that can be...

tasks 安全漏洞

tasks is an open source application for to-do lists and reminders from tasks open source. A security vulnerability exists in tasks versions prior to 12.7.1 and prior to 13.0.1 that stems from a lack of authentication, which allows a malicious or compromised application on the same device to...

CVE-2022-41489

WAYOS LQ09 22.03.17V was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to send crafted requests to the server from the affected device. This vulnerability is exploitable due to a lack of authentication in the component Usbupload.htm...

CVE-2022-39873

Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret mode without user authentication...

Carlo Gavazzi UWP 访问控制错误漏洞

Carlo Gavazzi UWP is a monitoring and control Universal Web Platform from Carlo Gavazzi. for applications such as building automation, energy efficiency performance management, and parking lot guidance. Carlo Gavazzi UWP 3.0 suffers from an Access Control Error vulnerability that stems from a lac...

PT-2022-6406 · NetGear · Netgear Cax30

Name of the Vulnerable Software and Affected Versions: NETGEAR CAX30S versions affected versions not specified NETGEAR CAX30 versions affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR routers...

Vulnerabilities fixed in Microsoft Office products

Microsoft has fixed vulnerabilities in several Office products. A malicious party could exploit the vulnerabilities to execute arbitrary code in the context of the application. To execute code in Office and Visio, the malicious party does not need prior authentication, but needs to trick the vict...