PT-2023-5081 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: The issue is caused by a buffer overflow vulnerability in the set openvpn client function of the Milesight UR32L router's firmware. This vulnerability can be exploited by a remote attacker to...

PT-2023-5082 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: The issue is caused by a buffer overflow vulnerability in the set dmvpn function of the Milesight UR32L router's firmware, due to the use of an unsafe sprintf pattern. This can be exploited by a...

PT-2023-5176 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: The issue is caused by multiple buffer overflow vulnerabilities in the vtysh ubus binary due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code...

PT-2023-5149 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: The issue is caused by a buffer overflow vulnerability in the set l2tp function of the vtysh ubus binary, due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to...

PT-2023-5147

Name of the Vulnerable Software and Affected Versions Milesight UR32L version 32.3.0.5 Description The issue is caused by a buffer overflow vulnerability in the firewall handler set function of the Milesight UR32L router's firmware. This vulnerability can be exploited by a remote attacker to...

PT-2023-5070

Name of the Vulnerable Software and Affected Versions Milesight UR32L version 32.3.0.5 Description Multiple buffer overflow vulnerabilities exist in the vtysh ubus binary due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacke...

PT-2023-5072

Name of the Vulnerable Software and Affected Versions Milesight UR32L version 32.3.0.5 Description Multiple buffer overflow vulnerabilities exist in the vtysh ubus binary due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacke...

PT-2023-5086

Name of the Vulnerable Software and Affected Versions Milesight UR32L version 32.3.0.5 Description Multiple buffer overflow vulnerabilities exist in the vtysh ubus binary due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacke...

Milesight UR32L buffer error vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. A buffer overflow vulnerability exists in the Milesight UR32L firewallhandlerset function, which can be exploited by an attacker to cause a buffer overflow and execute arbitrary code on the system, or cause an application to...

Milesight UR32L buffer error vulnerability

The Milesight UR32L is an industrial router from China-based Milesight. A buffer overflow vulnerability exists in the Milesight UR32L setqos function, which can be exploited by an attacker to cause a buffer overflow and execute arbitrary code on the system, or cause an application to crash...

Milesight UR32L buffer error vulnerability

The Milesight UR32L is an industrial router from China-based Milesight. A buffer overflow vulnerability exists in the Milesight UR32L firewallhandlerset function, which can be exploited by an attacker to cause a buffer overflow and execute arbitrary code on the system, or cause an application to...

Milesight UR32L buffer error vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. A buffer overflow vulnerability exists in the Milesight UR32L firewallhandlerset function due to incorrect boundary checking in the firewallhandlerset function. An authenticated, remote attacker could use this vulnerability to...

GHSA-H755-8QP9-CQ85 protobufjs Prototype Pollution vulnerability

protobuf.js aka protobufjs 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and...

USN-6198-1 screen vulnerability

It was discovered that GNU Screen was not properly checking user identifiers before sending certain signals to target processes. If GNU Screen was installed as setuid or setgid, a local attacker could possibly use this issue to cause a denial of service on a target application...

PT-2023-12499

Name of the Vulnerable Software and Affected Versions Opal Estate plugin for WordPress versions up to, and including, 1.6.11 Description The issue is due to missing or incorrect nonce validation on the opalestate set feature property and opalestate remove feature property functions. This allows...

CVE-2023-36470

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing document with an icon set, an attacker can inject XWiki syntax and Velocity code that is executed with programming rights and thus allows remote...

CLSA-2023-1688072526 Fix of 5 CVEs

CVE-2023-32233 // CVE-url: https://ubuntu.com/security/CVE-2023-32233 - netfilter: nftables: add nftsetisanonymous helper - netfilter: nftables: split set destruction in deactivate and destroy phase - netfilter: nftables: unbind set in rule from commit path - netfilter: nftables: fix set...

CLSA-2023-1688072342 Fix of 5 CVEs

CVE-2023-32233 // CVE-url: https://ubuntu.com/security/CVE-2023-32233 - netfilter: nftables: add nftsetisanonymous helper - netfilter: nftables: split set destruction in deactivate and destroy phase - netfilter: nftables: unbind set in rule from commit path - netfilter: nftables: fix set...

CVE-2023-36470

CVE-2023-36470 affects XWiki Platform. When a document is created or edited using an icon set, an attacker can inject XWiki syntax and Velocity code that runs with programming rights, enabling remote code execution. Attack vectors include the icon set HTML/XWiki syntax definitions and the icon pi...

CVE-2023-36470 Code injection in icon themes of XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing document with an icon set, an attacker can inject XWiki syntax and Velocity code that is executed with programming rights and thus allows remote...