CVE-2022-42168

Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/fromSetIpMacBind...

Product Stock Manager < 1.0.5 - Subscriber+ Unauthorised AJAX Calls

The plugin does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to update arbitrary options To set the default role for new users to administrator, run the below command in t...

PT-2022-12940

Name of the Vulnerable Software and Affected Versions HW KEYMASTER affected versions not specified Description The issue is related to an out-of-bounds access vulnerability in the parameter set verification of the HW KEYMASTER module. This vulnerability can be exploited to cause malicious...

CVE-2021-46840

The HWKEYMASTER module has an out-of-bounds access vulnerability in parameter set verification.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access...

CVE-2021-46840

The HWKEYMASTER module has an out-of-bounds access vulnerability in parameter set verification.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access...

CVE-2021-46840

CVE-2021-46840 affects Huawei HarmonyOS HW_KEYMASTER module, with an out-of-bounds access vulnerability in parameter set verification that could enable attacker-constructed data to trigger an out-of-bounds condition. The issue is described across several sources (NVD/NIST and CNNVD) as a vulnerab...

CVE-2021-46840: Out-of-bounds Read

The HWKEYMASTER module has an out-of-bounds access vulnerability in parameter set verification.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access...

ALPINE-CVE-2022-42719

A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers able to inject WLAN frames to crash the kernel and potentially execute code...

CVE-2022-42161

D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the /SetTriggerWPS/PIN parameter at function SetTriggerWPS...

CVE-2022-42160

D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the systemtimetimezone parameter at function SetNTPServerSettings...

[ADM Service]"failed with error Unable to set capacity" when allocate ADC licence in Cloud

The newly built ADC VPX could successfully onboarding to Cloud ADM Service. However, when allocate ADC VPX Instance and Bandwidth license to VPX in ADM service GUI page, opeartion failied with below error prompt: "Failed to set capacity. Reason:Command failed on ... Request to ... failed with err...

CVE-2022-42078

Tenda AC1206 USAC1206V1.0RTLV15.03.06.23multiTD01 is vulnerable to Cross Site Request Forgery CSRF via function fromSysToolRestoreSet...

Rizin Buffer Overflow

The vulnerability of the Rizin command-line tool set is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

FortiOS Command Injection

The vulnerability of the FortiOS operating system exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2022-20423

In rndissetresponse of rndis.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious USB device is attached with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

UBUNTU-CVE-2022-20423

In rndissetresponse of rndis.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious USB device is attached with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

mxGraph Cross-Site Script Vulnerability

mxGraph is a JavaScript charting library. A security vulnerability exists in mxGraph version v4.2.2, which stems from the discovery of a cross-site scripting XSS vulnerability contained via the setTooltips function...

PT-2022-25387 · Mxgraph · Mxgraph

Name of the Vulnerable Software and Affected Versions: mxGraph version 4.2.2 Description: The issue is related to a cross-site scripting XSS vulnerability. It occurs via the setTooltips function, which is susceptible to XSS attacks. Recommendations: For mxGraph version 4.2.2, consider disabling t...

PT-2022-04: Cross Site Template Injection (CSTI)

Input validation was missing while creating the working set, in working set manager application. Nokia NetAct users can create a Working Set with a name that injects a client-side template Injection payloads. The attack can only be performed by an internal user. The vulnerability is fixed in NetA...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2022-2413)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...