PYSEC-2022-42976

A stored cross-site scripting XSS vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI...

RUSTSEC-2022-0064 X.509 Email Address 4-byte Buffer Overflow

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate...

CVE-2020-21016

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings.php...

Atlassian Bitbucket Command Injection (CVE-2022-36804)

A command injection vulnerability exists in Atlassian Bitbucket. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

total.js 操作系统命令注入漏洞

total.js is open source a framework developed using JavaScript for the Node.js platform. It can be used to develop web, desktop, service and IoT platforms. An operating system command injection vulnerability exists in versions of total.js prior to 0e5ace7, which stems from /api/common/ping can be...

CVE-2021-38395

Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition...

CVE-2021-38397 Honeywell Experion PKS and ACE Controllers Unrestricted Upload of File with Dangerous Type

Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition...

CVE-2021-38395 Honeywell Experion PKS and ACE Controllers Injection

Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition...

PT-2022-5306

Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.0.0 through 3.0.6 Description A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. This occurs after certificate chain signature verification and requires either a CA...

Advantech R-SeeNet 缓冲区错误漏洞

Advantech R-SeeNet is an industrial monitoring software from Advantech China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet 2.4.17 and previous versions have a security vulnerability that can be exploited to...

Delta Industrial Automation InfraSuite Device Master Device-DataCollect Service Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation InfraSuite Device Master. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Device-DataCollect service, which listens on TC...

CVE-2022-32765

An OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability...

Exploit for Improper Handling of Exceptional Conditions in Google Chrome

--- The PoC/Exploit of some interesting vulnerabilities A...

PT-2022-19637 · Abode Systems · Iota All-In-One Security Kit

Name of the Vulnerable Software and Affected Versions: Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z Description: A command injection issue exists in the web interface's util set serial mac functionality, allowing arbitrary command execution via a specially-crafted HTTP...

Abode Iota 操作系统命令注入漏洞

Abode Iota is a reliable Diy home security system from Abode. An operating system command injection vulnerability exists in Abode Iota All-In-One Security Kit versions 6.9X and 6.9Z. An attacker could exploit this vulnerability to execute arbitrary commands via specially crafted HTTP requests...

Ubuntu 16.04 ESM : Open vSwitch vulnerability (USN-5698-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5698-2 advisory. USN-5698-1 fixed a vulnerability in Open. This update provides the corresponding update for Ubuntu 16.04 ESM. Tenable has extracted the preceding description bloc...

Exploit for Improper Authentication in Fortinet Fortiproxy

CVE-2022-40684 CVE-2022-40684 Remote Fortinet Code Exeuction v...

Bentley Systems MicroStation 安全漏洞

Bentley Systems MicroStation is a Cad software platform for 2D and 3D design and drafting from Bentley Systems, USA. Bentley Systems MicroStation Connect has security vulnerabilities. Exploitation of these vulnerabilities by an attacker could cause the device being accessed to crash or allow remo...

GNU Gzip zgrep Argument Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GNU Gzip. Interaction with this script is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of special...

USN-5694-1 libreoffice vulnerabilities

It was discovered that LibreOffice incorrectly handled links using the Office URI Schemes. If a user were tricked into opening a specially crafted document, a remote attacker could use this issue to execute arbitrary scripts. CVE-2022-3140 Thomas Florian discovered that LibreOffice incorrectly...