jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

man2html 输入验证错误漏洞

man2html is a pure manroff to html converter developed by HAMANO Tsukasa in Japan. A security vulnerability exists in man2html version 1.6g, which can be exploited to overwrite the previous size parameter of the next block and the fd, bk, fdnextsize, bknextsize parameters of the current block wit...

TOTOLINK A860R Command Injection Vulnerability

TOTOLINK A860R is a dual-band wireless router with a maximum transmission rate of 1200Mbps, 6-antenna dual-band concurrent technology, and support for remote management by mobile APP, which is suitable for small and medium-sized enterprises and home network environments. TOTOLINK A860R suffers fr...

NETGEAR R6200v2 操作系统命令注入漏洞

The NETGEAR R6200v2 is a dual-band Gigabit wireless router from NETGEAR that complies with the IEEE 802.11ac standard. The NETGEAR R6200v2 suffers from a command injection vulnerability that originates from allowing a remotely authenticated attacker to modify values in vulnerable parameters. No...

CVE-2022-30078

NETGEAR R6200V2 firmware versions through R6200v2-V1.0.3.1210.1.11 and R6300V2 firmware versions through R6300v2-V1.0.4.5210.0.93 allow remote authenticated attackers to execute arbitrary command via shell metacharacters in the ipv6fix.cgi ipv6wanipaddr, ipv6lanipaddr, ipv6wanlength, or...

CVE-2022-37843

In TOTOLINK A860R V4.1.2cu.5182B20201027 in cstecgi.cgi, the acquired parameters are directly put into the system for execution without filtering, resulting in a command injection vulnerability...

CVE-2022-37842

In TOTOLINK A860R V4.1.2cu.5182B20201027, the parameters in infostat.cgi are not filtered, causing a buffer overflow vulnerability...

CVE-2022-37842

In TOTOLINK A860R V4.1.2cu.5182B20201027, the parameters in infostat.cgi are not filtered, causing a buffer overflow vulnerability...

CVE-2022-37843

In TOTOLINK A860R V4.1.2cu.5182B20201027 in cstecgi.cgi, the acquired parameters are directly put into the system for execution without filtering, resulting in a command injection vulnerability...

Mozilla Thunderbird Security Advisory (MFSA2022-31) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

TOTOLINK A860R 安全漏洞

TOTOLINK A860R is a dual-band wireless router with a maximum transmission rate of 1200Mbps, 6-antenna dual-band concurrent technology, and support for remote management by mobile APP, which is suitable for small and medium-sized enterprises and home network environments. TOTOLINK A860R suffers fr...

PT-2022-4844 · Trend Micro · Trend Micro Apex One +1

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex One affected versions not specified Trend Micro Apex One as a Service affected versions not specified Description: A vulnerability in the authentication procedure allows an attacker to bypass login authentication by falsifyin...

Crime Reporting System 跨站脚本漏洞

Crime Reporting System is an online crime reporting system by the individual developer Tedmar Enoria. A security vulnerability exists in the Crime Reporting System version 1.0 that could allow a remote attacker to introduce arbitrary Javascript by manipulating unprocessed POST parameters...

PT-2022-24112 · Totolink · Totolink A860R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A860R version 4.1.2cu.5182 B20201027 Description: The issue arises from the direct execution of acquired parameters in the system without proper filtering, leading to a command injection vulnerability. This occurs in the cstecgi.cgi...

national-parameters.mofep.gov.gh Cross Site Scripting vulnerability OBB-2888336

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

DEBIAN-CVE-2022-39176

BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate paramslen...

UBUNTU-CVE-2022-39176

BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate paramslen...

Torro Forms <= 1.0.16 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...

PT-2024-8428 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a DMA mappings leak in the Linux kernel's ice component. This leak occurs when a user changes ring parameters, and new DMA mappings are created for RX buffers...

Meet My Team <= 2.0.5 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...