4720 matches found
PT-2022-19674 · Unknown +1 · Hmi Gc-A2 Series +2
Name of the Vulnerable Software and Affected Versions: Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01 HMI GC-A2 series versions including GC-A22W-CW, GC-A24W-CW, GC-A26W-CW, GC-A24, GC-A24-M, GC-A25, GC-A26, and GC-A26-J2 Real time remote monitoring and control tool Remote GC...
PT-2022-20004
Name of the Vulnerable Software and Affected Versions Belkin N300 Firmware version 1.00.08 Description The script located at "/setting hidden.asp" exhibits multiple remote command injection vulnerabilities. The parameters in the form are not properly sanitized after being submitted to the web...
Belkin N300 Firmware 操作系统命令注入漏洞
Belkin N300 Firmware is firmware for Belkin's Belkin N300 router. A security vulnerability exists in Belkin N300 Firmware version 1.00.08, which stems from multiple remote command injection vulnerabilities in the script /settinghidden.asp accessible both before and after configuring the device. A...
CVE-2022-24108
The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted...
PT-2022-16469
Name of the Vulnerable Software and Affected Versions Skyoftech So Listing Tabs module version 2.2.0 for OpenCart Description The issue allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause...
PT-2022-14082 · Unknown +3 · Gnome-Control-Center +3
Name of the Vulnerable Software and Affected Versions: gnome-control-center affected versions not specified Description: The issue concerns the configuration of gnome-control-center in Ubuntu, which allowed Remote Desktop Sharing to be enabled by default. Additionally, turning off RDP Remote...
CVE-2022-1559
The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfilteredhtml capability is disallowed...
[WP-H0] Fake balances can be created for not-yet-existing ERC20 tokens, which allows attackers to set traps to steal funds from future users
Lines of code Vulnerability details function createVault uint256 tokenIdOrAmount, address token, ... external returns uint256 vaultId ... Vault memory vault = Vault ... ; // vault index should always be odd vaultIndex += 2; vaultId = vaultIndex; vaultsvaultId = vault; // give msg.sender vault tok...
GHSA-HPWM-84H5-VQR8 Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames
In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames...
Moodle Session Fixation vulnerability
Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks...
GHSA-8R7X-QQ55-74V2 Moodle does not enforce the forceloginforprofiles setting
user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the forceloginforprofiles setting, which allows remote attackers to obtain sensitive course-profile information by leveraging the guest role, as demonstrated by a Google search...
TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-5355)
TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK Electronics, Inc. A command injection vulnerability exists in TOTOLINK N600R, which can be exploited by attackers to conduct command injection attacks via the lagtype parameter in /setting/setLanguageCfg...
TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53554)
TOTOLINK N600R is a wireless router from Taiwan-based Gion Electronics TOTOLINK, China.A command injection vulnerability exists in TOTOLINK N600R, which can be exploited by attackers to conduct command injection attacks via the ipdoamin parameter in /setting/setDiagnosisCfg...
TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53552)
TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK, China.A command injection vulnerability exists in TOTOLINK N600R, which can be exploited by attackers to conduct command injection attacks via the devicemac parameter in /setting/setDeviceName...
TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53558)
TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK, which is vulnerable to a command injection attack via the webwlanidx parameter in /setting/setWebWlanIdx...
MyBB 1.8.29 - MyBB 1.8.29 - Remote Code Execution (Authenticated) Exploit
Exploit Title: MyBB 1.8.29 - Remote Code Execution RCE Authenticated Exploit Author: Altelus Vendor Homepage: https://mybb.com/ Software Link: https://github.com/mybb/mybb/releases/tag/mybb1829 Version: MyBB 1.8.29 Tested on: Linux CVE : CVE-2022-24734 An RCE can be obtained on MyBB's Admin CP in...
MyBB 1.8.29 Remote Code Execution
Exploit Title: MyBB 1.8.29 - Remote Code Execution RCE Authenticated Date: 2022-05-08 Exploit Author: Altelus Vendor Homepage: https://mybb.com/ Software Link: https://github.com/mybb/mybb/releases/tag/mybb1829 Version: MyBB 1.8.29 Tested on: Linux CVE : CVE-2022-24734 An RCE can be obtained on...
CVE-2022-28913
TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting...