CVE-2022-28372

On Verizon 5G Home LVSKIHP InDoorUnit IDU 3.4.66.162 and OutDoorUnit ODU 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning a firmware update for the device via crtcfwupgrade or crtcfwimage. The URL provided is not validated, and thus allows for arbitrary file uplo...

CVE-2022-28372

The CVE-2022-28372 entry describes a vulnerability in Verizon 5G Home LVSKIHP devices (IDU 3.4.66.162 and ODU 3.33.101.0). The CRTC and ODU RPC endpoints allow provisioning a firmware update via crtc_fw_upgrade or crtcfwimage; the provided URL is not validated, enabling arbitrary file upload to t...

PT-2022-18980 · Verizon · Verizon 5G Home Lvskihp Outdoorunit

Name of the Vulnerable Software and Affected Versions: Verizon 5G Home LVSKIHP InDoorUnit IDU version 3.4.66.162 Verizon 5G Home LVSKIHP OutDoorUnit ODU version 3.33.101.0 Description: The CRTC and ODU RPC endpoints rely on a static certificate for access control, which is embedded in the firmwar...

CVE-2022-22038 Remote Procedure Call Runtime Remote Code Execution Vulnerability

...

CVE-2022-22038

CVE-2022-22038 is a Remote Procedure Call Runtime Remote Code Execution vulnerability. Connected sources note a POC exploit exists and that exploitation would require multiple attempts with high attack complexity, potentially over a network. The available documents do not specify affected product...

CVE-2022-35411

rpc.py CVE-2022-35411 allows unauthenticated RCE via HTTP header serializer: pickle, triggering Python pickle deserialization in rpc.py up to v0.6.0. Affected versions are cited as v0.4.2–v0.6.0; exploits and demonstrations exist (e.g., PacketsStorm, Exploit-DB). Public exploitation code targets ...

rpc.py 代码问题漏洞

rpc.py is a fast and powerful ASGI/WSGI-based RPC framework for individual developers in Aber, China. A security vulnerability exists in rpc.py version 0.6.0 and earlier. An attacker exploited the vulnerability to process data using unpickle...

GHSA-F2GR-7299-487H DOS and excessive memory usage when passing untrusted user input to to dag import

Impact go-ipfs nodes crash when trying to import certain malformed CAR files due to an issue in the go-car dependency. This impacts nodes running ipfs dag import on untrusted user inputs, for example, pinning services with a car ingest endpoint. This include the corresponding HTTP RPC API...

DOS and excessive memory usage when passing untrusted user input to to dag import

Impact go-ipfs nodes crash when trying to import certain malformed CAR files due to an issue in the go-car dependency. This impacts nodes running ipfs dag import on untrusted user inputs, for example, pinning services with a car ingest endpoint. This include the corresponding HTTP RPC API...

Fedora: Security Advisory for golang-github-twitchtv-twirp (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: golang-github-twitchtv-twirp-8.1.0-4.fc36

A simple RPC framework with protobuf service definitions...

U.S. Dept Of Defense: xmlrpc.php file enabled at ██████.org

The XML-RPC API on WordPress allowed third-party applications and services to interact with WordPress sites, but it opened up two types of attacks: XML-RPC pingbacks and brute force attacks. The xmlrpc.php file was enabled on ██████.org, making it vulnerable to these attacks. Disabling or removin...

GSD-2022-1003483 NFSv4: Don't hold the layoutget locks across multiple RPC calls

NFSv4: Don't hold the layoutget locks across multiple RPC calls This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.122 by commit...

GSD-2022-1003226 NFSv4: Don't hold the layoutget locks across multiple RPC calls

NFSv4: Don't hold the layoutget locks across multiple RPC calls This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.47 by commit...

GSD-2022-1002560 NFSv4: Don't hold the layoutget locks across multiple RPC calls

NFSv4: Don't hold the layoutget locks across multiple RPC calls This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

Zoho Password Manager Pro XML-RPC Java Deserialization

This module exploits a Java deserialization vulnerability in Zoho ManageEngine Pro before 12101 and PAM360 before 5510. Unauthenticated attackers can send a crafted XML-RPC request containing malicious serialized data to /xmlrpc to gain RCE as the SYSTEM user. Module Options msf use...

MAL-2022-2973 Malicious code in fb-arcanist-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 241f4cc35eca1933b2b61749223d5ea2764029590ce5497f109e9ade1bb63f29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fb-arcanist-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 241f4cc35eca1933b2b61749223d5ea2764029590ce5497f109e9ade1bb63f29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2360 Malicious code in dazaar-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89f903f52f3dad9577a4a6136ab8ed7f78e6864758452e85caa58bd9e0fd980d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dazaar-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89f903f52f3dad9577a4a6136ab8ed7f78e6864758452e85caa58bd9e0fd980d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...