12792 matches found
Roundup xml-rpc server improper check of property permissions
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the 1 list, 2 display, and 3 set methods...
CVE-2022-21230
This affects all versions of package org.nanohttpd:nanohttpd. Whenever an HTTP Session is parsing the body of an HTTP request, the body of the request is written to a RandomAccessFile when the it is larger than 1024 bytes. This file is created with insecure permissions that allow its contents to ...
AZL-9655 CVE-2022-1249 affecting package pesign 0.112-32
A NULL pointer dereference flaw was found in pesign's cmssetpwdata function of the cmscommon.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign...
CVE-2021-34588
In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty after reboot...
PHP NumberFormatter setSymbol DoS
The vulnerability of the NumberFormatter::setSymbol function in the PHP programming language exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures remotely...
_revokeRole doesn't remove account from roleMember set
Lines of code Vulnerability details Impact The function doesn't remove the address from roleMembersrole set, which will mess up with the roleCount Proof of Concept Tools Used Recommended Mitigation Steps rolesrole.membersaccount = false; roleMembersrole.removeaccount; --- The text was updated...
CVE-2022-28521
ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=spsetconfig...
CVE-2022-28521
ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=spsetconfig...
QNAP QTS / QuTS Hero Default Credentials
The remote QNAP QTS or QuTS Hero web administration interface uses a known set of hard-coded default credentials. An attacker can exploit this to gain administrative access to the remote host. %NASLMINLEVEL 70300 C Tenable, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...
CVE-2022-27375
Tenda AX12 V22.03.01.21CN was discovered to contain a Cross-Site Request Forgery CSRF via the function sub422168 at /goform/WifiExtraSet...
CVE-2022-27375
Tenda AX12 V22.03.01.21CN was discovered to contain a Cross-Site Request Forgery CSRF via the function sub422168 at /goform/WifiExtraSet...
Tenda AX12 Cross-Site Request Forgery Vulnerability
Tenda AX12 is a dual-band Gigabit Wifi 6 wireless router from Tenda, China.Tenda AX12 V22.03.01.21CN firmware version is vulnerable to cross-site request forgery, which is caused by the sub422168 function of /goform/WifiExtraSet that does not sufficiently validate whether the request is from a...
PHP phar_set Code Execution
The vulnerability of the pharset inode function in the PHP language interpreter arises due to buffer overflow. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
GSD-2022-1001401 powerpc/set_memory: Avoid spinlock recursion in change_page_attr()
powerpc/setmemory: Avoid spinlock recursion in changepageattr This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.20 by commit...
PT-2025-8457
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A bug in the Linux kernel has been identified, specifically in the cx23885 driver. The issue arises when the driver fails to call the dma set mask function, resulting in a use-after-free...
PT-2022-29232
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.4 Description The issue is related to the i2c device, where the return value is not checked when calling the dev set name function. This could potentially lead to security vulnerabilities, although the actu...
PT-2022-29470
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.2 Description The issue is related to a potential underflow in the nldev stat set counter dynamic doit function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...
PT-2022-29785
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description The issue is related to a potential underflow in the nldev stat set counter dynamic doit function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linu...
PT-2025-8238
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock issue was found in the Linux kernel, specifically in the sa1100 set termios function. This occurs when two threads attempt to access the same lock, resulting in a situation...
