xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e. neither alphanumeric nor underscore) aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.

...

CVE-2023-40359

xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters i.e., neither alphanumeric nor underscore, aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature...

subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the...

subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the...

subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the...

subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the...

subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the...

Subscription-Manager security vulnerability

Subscription-Manager is a subscription management system by the individual developer youranreus in China. Subscription-Manager has a security vulnerability that stems from the fact that the D-Bus interface com.redhat.RHSM1 exposes a large number of methods to all users that can change the...

CVE-2023-39617

TOTOLINK X5000RV9.1.0cu.2089B20211224 and X5000RV9.1.0cu.2350B20230313 were discovered to contain a remote code execution RCE vulnerability via the lang parameter in the setLanguageCfg function...

CVE-2023-39617

TOTOLINK X5000RV9.1.0cu.2089B20211224 and X5000RV9.1.0cu.2350B20230313 were discovered to contain a remote code execution RCE vulnerability via the lang parameter in the setLanguageCfg function...

CVE-2023-39618

TOTOLINK X5000R B20210419 was discovered to contain a remote code execution RCE vulnerability via the setTracerouteCfg interface...

TOTOLINK X5000R Command Injection Vulnerability

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK X5000R version B20210419, which stems from a remote code execution RCE vulnerability in the setTracerouteCfg interface...

Tenda AC8 Buffer Error Vulnerability

Tenda AC8 is a wireless router from Tenda, China. A security vulnerability exists in Tenda AC8V4 version V16.03.34.06, which originates from a stack overflow vulnerability in the list parameter of the setqosMiblist function...

CVE-2023-4412

A vulnerability was found in TOTOLINK EX1200L ENV9.3.5u.6146B20201023 and classified as critical. This issue affects the function setWanCfg. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The...

CVE-2023-4411

A vulnerability has been found in TOTOLINK EX1200L ENV9.3.5u.6146B20201023 and classified as critical. This vulnerability affects the function setTracerouteCfg. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and m...

TOTOLINK EX1200L: Operating System Command Injection Vulnerability

The TOTOLINK EX1200L is a wireless repeater from China's Gion Electronics TOTOLINK. An operating system command injection vulnerability exists in the TOTOLINK EX1200L ENV9.3.5u.6146B20201023 version, which stems from the setTracerouteCfg function that could lead to a system command injection...

CLSA-2023-1692296244 Fix CVE(s): CVE-2023-30577

SECURITY UPDATE: privilege escalation through runtar SUID program - debian/patches/CVE-2023-30577.patch: introduce tar option allow list Fix changelog installation - CVE-2023-30577...

PT-2023-4716

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak flaw was found in the nft set catchall flush function in the net/netfilter/nf tables api.c component of the Linux kernel. This issue may allow a local attacker to cause...

PT-2025-40682

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the wifi subsystem, specifically in the cfg80211 component. The issue involves accepting authentication or association requests from an Access Poi...

WAVLINK WL-WNJ575A3: Command Injection Vulnerability

WAVLINK WL-WNJ575A3 is a wireless network signal extender from China RuiYin Technology WAVLINK. The WAVLINK WL-WNJ575A3 suffers from a command injection vulnerability that originates from an application failing to properly filter construct command special characters, commands, etc. The...