PT-2022-14114

Name of the Vulnerable Software and Affected Versions The New User Email Set Up WordPress plugin versions 0.5.2 and earlier Description The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Thi...

PT-2022-37033

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-double-free crash. The crash state includes functions such as nft set context free many, network unref, and network load one...

systemd:fuzz-network-parser: Heap-double-free in config_parse_nft_set_context

Detailed Report: https://oss-fuzz.com/testcase?key=5385039841460224 Project: systemd Fuzzing Engine: afl Fuzz Target: fuzz-network-parser Job Type: aflasansystemd Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x6030000001c0 Crash State: configparsenftsetcontext...

CVE-2018-25034

A vulnerability, which was classified as problematic, has been found in Thomson TCW710 ST5D.10.05. This issue affects some unknown processing of the file /goform/wlanPrimaryNetwork. The manipulation of the argument ServiceSetIdentifier with the input alert1 as part of POST Request leads to basic...

THOMSON TCW710 Cross-site Scripting Vulnerability

The THOMSON TCW710 is a set-top box from THOMSON Canada. A security vulnerability exists in the THOMSON TCW710 ST5D.10.05 version, which originates from an unknown section of the file /goform/RgDhcp. A remote attacker can exploit the vulnerability to cause a stored cross-site scripting attack usi...

PT-2022-37030

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-double-free crash. The crash occurs in the nft set context free many function, which is called by config parse nft set conte...

THOMSON TCW710 Cross-site Scripting Vulnerability

Thomson Reuters THOMSON TCW710 is a set-top box from Thomson Reuters Canada. A cross-site scripting vulnerability exists in the THOMSON TCW710 ST5D.10.05 version, which originates from certain unknown processing in the file /goform/wlanPrimaryNetwork. A remote attacker could use this vulnerabilit...

PT-2022-8046 · Thomson · Thomson Tcw710

Name of the Vulnerable Software and Affected Versions: Thomson TCW710 version ST5D.10.05 Description: A problematic issue has been found in the processing of the file /goform/wlanPrimaryNetwork. The manipulation of the ServiceSetIdentifier argument with the input alert1 as part of a POST Request...

systemd:fuzz-network-parser: Heap-double-free in nft_set_context_free_many

Project: https://github.com/systemd/systemd.git Detailed Report: https://oss-fuzz.com/testcase?key=6592078156529664 Project: systemd Fuzzing Engine: honggfuzz Fuzz Target: fuzz-network-parser Job Type: honggfuzzasansystemd Platform Id: linux Crash Type: Heap-double-free Crash Address:...

CVE-2022-30918

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AspSetTelnet parameter at /goform/aspForm...

OpenJDK: Excessive memory allocation in HashMap and HashSet (Utility, 8266097)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Utility. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated...

PT-2022-20373

Name of the Vulnerable Software and Affected Versions H3C Magic R100 version R100V100R005 Description A stack overflow issue was discovered via the ipqos set bandwidth parameter at the "/goform/aspForm" API endpoint. Recommendations For H3C Magic R100 version R100V100R005, consider restricting...

CVE-2022-29631

Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequestset and jodd.http.HttpRequestsend. These vulnerabilities allow attackers to execute Server-Side Request Forgery SSRF via a crafted TCP payload...

CVE-2022-29631: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequestset and jodd.http.HttpRequestsend. These vulnerabilities allow attackers to execute Server-Side Request Forgery SSRF via a crafted TCP payload...

CVE-2021-42884

TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceName of the file global.so which can control thedeviceName to attack...

PT-2022-19822

Name of the Vulnerable Software and Affected Versions AlekSIS-Core versions 2.8.1 and below Description An access control issue in aleksis/core/util/auth helpers.py, specifically in the ClientProtectedResourceMixin, allows attackers to access arbitrary scopes if no allowed scopes are specifically...

PT-2022-11729 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T version 4.1.2cu.5215 Description: The issue concerns a remote command injection vulnerability. It is located in the setDeviceMac function of the global.so file, allowing control over the deviceName to launch an attack...

CVE-2021-42875

TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cstemodules/system.so to control the ipDoamin...

CVE-2022-30503

Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njssetnumber at src/njsvalue.h...

PT-2022-14382

Name of the Vulnerable Software and Affected Versions Android versions Android-10 through Android-12L Description The issue is related to a possible out of bounds write due to a missing bounds check in the nfa dm check set config function of nfa dm main.cc. This could lead to local escalation of...