PT-2020-1242 · Libyang · Libyang

Name of the Vulnerable Software and Affected Versions: libyang versions prior to 1.0-r3 Description: A NULL pointer dereference issue is present in the lys extension instances free function due to a copy of unresolved extensions in lys restr dup. This can cause applications that use libyang to...

GLSA-201904-17 : Patch: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201904-17 Patch: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Patch. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for details...

Patch: Multiple vulnerabilities

Background Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions. Description Multiple vulnerabilities have been discovered in Patch. Please review the CVE identifiers reference...

Directory traversal

A directory traversal vulnerability was discovered in Enphase Envoy R3.. via images/, include/, include/js, or include/css on TCP port 8888...

CVE-2019-7677

XSS exists in Enphase Envoy R3.. via the profileName parameter to the /home URI on TCP port 8888...

CVE-2019-7678

A directory traversal vulnerability was discovered in Enphase Envoy R3.. via images/, include/, include/js, or include/css on TCP port 8888...

CVE-2019-7676

CVE-2019-7676 affects Enphase Envoy R3.. ; a weak password vulnerability allows remote attackers to log in to the admin account via TCP port 8888 using the admin password. Reported impact includes partial confidentiality, integrity, and availability. CVSS data from sources indicate base scores of...

Command injection

OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data...

CVE-2018-14010

OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data...

CVE-2018-14010

OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data...

CVE-2018-14010

The CVE-2018-14010 issue affects Xiaomi routers (R3P, R3C, R3, R3D) via the guest Wi‑Fi settings feature in /cgi-bin/luci. Affected firmware versions are R3P < 2.14.5, R3C < 2.12.15, R3 < 2.22.15, and R3D

Null pointer dereference

Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer values. An attacker who is able to execute code on the target may be able to exploit this vulnerability to obtain SYSTEM privileges...

Remote Arbitrary Command Execution Vulnerability in Guest wi-fi Settings Function of Multiple Xiaomi Routers

Xiaomi Router R3D/R3P/R3C/R3 are router products. A remote arbitrary command execution vulnerability exists in the guest wi-fi settings feature of multiple Xiaomi routers. An attacker can exploit this vulnerability to remotely execute arbitrary code...

r3.org.uk XSS vulnerability

Open Bug Bounty ID: OBB-554383 Description| Value ---|--- Affected Website:| r3.org.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

OpenSSH: Permission issue

Background OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support. Description The processopen function in sftp-server.c in OpenSSH did not properly prevent write operations in readonly mode. Impact A remote attacker could cause the creation of zero-length...

GLSA-201701-50 : PPP: Buffer overflow

The remote host is affected by the vulnerability described in GLSA-201701-50 PPP: Buffer overflow A buffer overflow was discovered in the rcmksid function in plugins/radius/util.c in PPP when the PID for pppd is greater than 65535. Impact : A remote attacker could cause a Denial of Service...

Notilus Travel Solution Software 2012 R3 - SQL Injection

Exploit for php platform in category web applications Exploit Title: Notilus SQL injection Product: Notilus travel solution software Vulnerable Versions: 2012 R3 Tested Version: 2012 R3 Advisory Publication: 03/06/2016 Vulnerability Type: Improper Neutralization of Special Elements used in an SQL...

Notilus Travel Solution Software 2012 R3 - SQL Injection

Notilus Travel Solution Software 2012 R3 - SQL Injection Exploit Title: Notilus SQL injection Product: Notilus travel solution software Vulnerable Versions: 2012 R3 Tested Version: 2012 R3 Advisory Publication: 03/06/2016 Vulnerability Type: Improper Neutralization of Special Elements used in an...

Notilus 2012 R3 SQL Injection

Exploit Title: Notilus SQL injection Product: Notilus travel solution software Vulnerable Versions: 2012 R3 Tested Version: 2012 R3 Advisory Publication: 03/06/2016 Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' CWE-89 CVE Reference: NONE...

Design/Logic Flaw

The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attackers to obtain network access via a brute-force attack...