6788 matches found
Default credentials
D-Link GO-RT-AC750 GORTAC750revAv101b03 & GO-RT-AC750revBFWv200b02 is vulnerable to Static Default Credentials via /etc/init0.d/S80telnetd.sh...
CVE-2022-36524
D-Link GO-RT-AC750 GORTAC750revAv101b03 & GO-RT-AC750revBFWv200b02 is vulnerable to Static Default Credentials via /etc/init0.d/S80telnetd.sh...
CVE-2022-36524
The CVE-2022-36524 entry concerns D-Link GO-RT-AC750 routers (GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02). Affected component/entry point is the init script /etc/init0.d/S80telnetd.sh, enabling static default credentials. This creates a network-accessible risk vector with high impact t...
CVE-2022-33989
dproxy-nexgen aka dproxy nexgen uses a static UDP source port selected randomly only at boot time in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to prevent traffic injection attacks...
Design/Logic Flaw
dproxy-nexgen aka dproxy nexgen uses a static UDP source port selected randomly only at boot time in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to prevent traffic injection attacks...
CVE-2022-33989
dproxy-nexgen aka dproxy nexgen uses a static UDP source port selected randomly only at boot time in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to prevent traffic injection attacks...
dproxy 安全特征问题漏洞
dproxy is an intelligent caching DNS proxy from the personal developer Matthew Pratt. dproxy suffers from a security vulnerability that stems from the use of static UDP source ports randomly selected only at startup in the upstream queries it sends to DNS resolvers. This allows the DNS cache to b...
D-Link GO-RT-AC750 授权问题漏洞
The D-Link GO-RT-AC750 is a wireless dual-band simple router from China's AUO D-Link. A security vulnerability exists in the D-Link GO-RT-AC750 GORTAC750revAv101b03 and GO-RT-AC750revBFWv200b02, which stems from a susceptibility to static default credentials attack from /etc/init0.d/S80telnetd.sh...
PT-2022-21951 · Unknown · Dproxy-Nexgen
Name of the Vulnerable Software and Affected Versions: dproxy-nexgen affected versions not specified Description: The issue allows DNS cache poisoning due to the use of a static UDP source port with insufficient entropy to prevent traffic injection attacks. This occurs because dproxy-nexgen selec...
Deposit does not verify if tokens are transfered successfully
Lines of code Vulnerability details please find below one report encapsulating 2 M bugs which are the exact same bug found in two seperate functions within the same .sol file M1 No Return Value on transferFrom VotingEscrow.sol makes checks to be sure that the transferFrom function is sending to t...
MGASA-2022-0280 Updated ruby-sinatra packages fix security vulnerability
Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files. CVE-2022-29970...
Updated ruby-sinatra packages fix security vulnerability
Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files. CVE-2022-29970...
Packj - Large-Scale Security Analysis Platform To Detect Malicious/Risky Open-Source Packages
Packj pronounced package is a command line CLI tool to vet open-source software packages for "risky" attributes that make them vulnerable to supply chain attacks. This is the tool behind our large-scale security analysis platform Packj.dev that continuously vets packages and provides free reports...
The Truth About False Positives in Security
TL;DR: As weird as it might sound, seeing a few false positives reported by a security scanner is probably a good sign and certainly better than seeing none. Let's explain why. Introduction False positives have made a somewhat unexpected appearance in our lives in recent years. I am, of course,...
The Truth About False Positives in Security
TL;DR: As weird as it might sound, seeing a few false positives reported by a security scanner is probably a good sign and certainly better than seeing none. Let's explain why. Introduction False positives have made a somewhat unexpected appearance in our lives in recent years. I am, of course,...
GHSA-8CW9-5HMV-77W6 sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
Impact Access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Patches - v20.12.7 LTS - v21.12.2 LTS - v22.6.1 References https://github.com/sanic-org/sanic/issues/2478 https://github.com/sanic-org/sanic/pull/2495 For more...
sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
Impact Access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Patches - v20.12.7 LTS - v21.12.2 LTS - v22.6.1 References https://github.com/sanic-org/sanic/issues/2478 https://github.com/sanic-org/sanic/pull/2495 For more...
Unspecified vulnerability in Tencent TscanCode tsclua
Tencent TscanCode is a fast and accurate static analysis solution for C/C++, C and Lua code from Tencent. Tencent TscanCode tsclua suffers from an unspecified vulnerability that stems from its lua parser that allows an attacker to cause a denial of service via a crafted lua script. No detailed...
CVE-2022-35929 False positive signature verification in cosign
cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...
openSUSE: Security Advisory for permissions (SUSE-SU-2022:2632-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...