ZTE MF286R和ZTE MF289D SQL注入漏洞

ZTE MF286R and ZTE MF289D are both products of ZTE Corporation ZTE, China.ZTE MF286R is a wireless router.ZTE MF289D is a home wireless router. ZTE Mobile MF286R, MF289D has a SQL injection vulnerability that originates from insufficient validation of the input parameters of the NTP interface,...

CVE-2014-125036

A vulnerability, which was classified as problematic, has been found in drybjed ansible-ntp. Affected by this issue is some unknown functionality of the file meta/main.yml. The manipulation leads to insufficient control of network message volume. The attack can only be done within the local...

Design/Logic Flaw

A vulnerability, which was classified as problematic, has been found in drybjed ansible-ntp. Affected by this issue is some unknown functionality of the file meta/main.yml. The manipulation leads to insufficient control of network message volume. The attack can only be done within the local...

CVE-2014-125036 drybjed ansible-ntp main.yml amplification

A vulnerability, which was classified as problematic, has been found in drybjed ansible-ntp. Affected by this issue is some unknown functionality of the file meta/main.yml. The manipulation leads to insufficient control of network message volume. The attack can only be done within the local...

CVE-2014-125036

CVE-2014-125036 affects drybjed ansible-ntp; the issue concerns the file meta/main.yml where manipulation leads to insufficient control of network message volume. Impact is described as local-network–only with low complexity; exploitability details are not provided in the sources. A patch is avai...

PT-2023-10106 · Unknown · Drybjed Ansible-Ntp

Name of the Vulnerable Software and Affected Versions: drybjed ansible-ntp affected versions not specified Description: A problematic vulnerability has been found in drybjed ansible-ntp, affecting some unknown functionality of the file meta/main.yml. The manipulation leads to insufficient control...

Moderate: Red Hat Security Advisory: Red Hat OpenStack 16.1.9 (openstack-tripleo-heat-templates) security update

An update for openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 16.1.9 Train for Red Hat Enterprise Linux RHEL 8.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

CVE-2022-36786

DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers Network Time Protocol via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router...

Command injection

DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers Network Time Protocol via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router...

CVE-2022-36786 DLINK - DSL-224 Post-auth RCE.

DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers Network Time Protocol via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router...

PT-2022-23625 · D Link · Dlink Router

Name of the Vulnerable Software and Affected Versions: DLINK router version 3.0.8 Description: The issue allows for command injection through the interface used to configure NTP servers via jsonrpc API, potentially running commands with ROOT permissions on the router. This is made possible by...

CVE-2022-36786

DLINK DSL-224 router (firmware 3.0.8) is affected by a post-auth command injection via the NTP configuration interface exposed through a jsonrpc API. The underlying issue allows commands to run with ROOT privileges on the device, per multiple sources. Practical impact includes full device comprom...

dnsmasq security and bug fix update

2.79-24 - Prevent endless loop in forwardquery 2120357 2.79-23 - Add IPv6 ntp-server suboptions support 2049691 2.79-22 - Prevent use after free in dhcp6norelay CVE-2022-0934...

SUSE-SU-2022:3959-1 Security update for busybox

This update for busybox fixes the following issues: - Enable switchroot With this change virtme --force-initramfs works as expected. - Enable udhcpc busybox was updated to 1.35.0 - Adjust busybox.config for new features in find, date and cpio - Annotate CVEs already fixed in upstream, but not...

Sandman - NTP Based Backdoor For Red Team Engagements In Hardened Networks

Sandman is a backdoor that is meant to work on hardened networks during red team engagements. Sandman works as a stager and leverages NTP a protocol to sync time & date to get and run an arbitrary shellcode from a pre-defined server. Since NTP is a protocol that is overlooked by many defenders...

Android and iOS leak some data outside VPNs

Virtual Private Networks VPNs on Android and iOS are in the news. Its been discovered that in certain circumstances, some of your traffic is leaked so it ends up outside of the safety cordon created by the VPN. Mullvad, the discoverers of this Android "feature" say that it has the potential to...

Command injection

D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the systemtimetimezone parameter at function SetNTPServerSettings...

CVE-2022-42160

D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the systemtimetimezone parameter at function SetNTPServerSettings...

CVE-2022-37125

D-link DIR-816 A2v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost...

Ubuntu: Security Advisory (USN-867-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...