CVE-2022-30473

Tenda AC Series Router AC18V15.03.05.196318 has a stack-based buffer overflow vulnerability in function formfastsettingwifiset...

Tenda AC Series Router 缓冲区错误漏洞

Tenda AC Series Router is a series of wireless routers from Tenda China. A security vulnerability exists in Tenda AC Series Router AC18V15.03.05.196318, which originates from a stack-based buffer overflow vulnerability in the formfastsettingwifiset function...

GHSA-9JRX-FGRM-96QH Mattermost Server is vulnerable to XSS via a Legal or Support setting

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting...

Mattermost Server is vulnerable to XSS via a Legal or Support setting

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale which is packaged in IBM ESS (CVE-2020-4926)

Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale which is packaged in IBM ESS where an unauthorized user can send arbitrary data to the CLI commands and daemon. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2020-4926 DESCRIPTION...

CVE-2022-30105

In Belkin N300 Firmware 1.00.08, the script located at /settinghidden.asp, which is accessible before and after configuring the device, exhibits multiple remote command injection vulnerabilities. The following parameters in the form name form; list vulnerable parameters, are not properly sanitize...

Belkin N300 Firmware 操作系统命令注入漏洞

Belkin N300 Firmware is firmware for Belkin's Belkin N300 router. A security vulnerability exists in Belkin N300 Firmware version 1.00.08, which stems from multiple remote command injection vulnerabilities in the script /settinghidden.asp accessible both before and after configuring the device. A...

PT-2022-19674 · Unknown +1 · Hmi Gc-A2 Series +2

Name of the Vulnerable Software and Affected Versions: Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01 HMI GC-A2 series versions including GC-A22W-CW, GC-A24W-CW, GC-A26W-CW, GC-A24, GC-A24-M, GC-A25, GC-A26, and GC-A26-J2 Real time remote monitoring and control tool Remote GC...

CVE-2022-24108

The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted...

PT-2022-14082 · Unknown +3 · Gnome-Control-Center +3

Name of the Vulnerable Software and Affected Versions: gnome-control-center affected versions not specified Description: The issue concerns the configuration of gnome-control-center in Ubuntu, which allowed Remote Desktop Sharing to be enabled by default. Additionally, turning off RDP Remote...

CVE-2022-1559

The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfilteredhtml capability is disallowed...

[WP-H0] Fake balances can be created for not-yet-existing ERC20 tokens, which allows attackers to set traps to steal funds from future users

Lines of code Vulnerability details function createVault uint256 tokenIdOrAmount, address token, ... external returns uint256 vaultId ... Vault memory vault = Vault ... ; // vault index should always be odd vaultIndex += 2; vaultId = vaultIndex; vaultsvaultId = vault; // give msg.sender vault tok...

GHSA-HPWM-84H5-VQR8 Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames

In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames...

Moodle Session Fixation vulnerability

Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks...

GHSA-8R7X-QQ55-74V2 Moodle does not enforce the forceloginforprofiles setting

user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the forceloginforprofiles setting, which allows remote attackers to obtain sensitive course-profile information by leveraging the guest role, as demonstrated by a Google search...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53554)

TOTOLINK N600R is a wireless router from Taiwan-based Gion Electronics TOTOLINK, China.A command injection vulnerability exists in TOTOLINK N600R, which can be exploited by attackers to conduct command injection attacks via the ipdoamin parameter in /setting/setDiagnosisCfg...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53552)

TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK, China.A command injection vulnerability exists in TOTOLINK N600R, which can be exploited by attackers to conduct command injection attacks via the devicemac parameter in /setting/setDeviceName...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-5355)

TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK Electronics, Inc. A command injection vulnerability exists in TOTOLINK N600R, which can be exploited by attackers to conduct command injection attacks via the lagtype parameter in /setting/setLanguageCfg...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53558)

TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK, which is vulnerable to a command injection attack via the webwlanidx parameter in /setting/setWebWlanIdx...

MyBB 1.8.29 - MyBB 1.8.29 - Remote Code Execution (Authenticated) Exploit

Exploit Title: MyBB 1.8.29 - Remote Code Execution RCE Authenticated Exploit Author: Altelus Vendor Homepage: https://mybb.com/ Software Link: https://github.com/mybb/mybb/releases/tag/mybb1829 Version: MyBB 1.8.29 Tested on: Linux CVE : CVE-2022-24734 An RCE can be obtained on MyBB's Admin CP in...