CVE-2022-40284

A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon...

CVE-2022-40284

A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon...

CVE-2022-40284

A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon...

CVE-2022-40284

A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon...

Intel Memory Bug Poses Risk for Hundreds of Products

Chipmaker Intel is reporting a memory bug impacting microprocessor firmware used in “hundreds” of products. According to an advisory issued by the company on Tuesday, the bug is firmware-based and rated as “high” risk with a Common Vulnerability Scoring System CVSS score of 7. The vulnerability...

CVE-2021-0308

An out-of-bounds write flaw was found in gdisks' ReadLogicalParts function of 'basicmbr.cc'. The exploitation of this flaw requires the use of a malicious storage device for example, a USB Stick that can cause a crash when physically inserted into the system and possible local privilege escalatio...

USN-5262-1 gdisk vulnerabilities

The potential for an out of bounds write due to a missing bounds check was discovered to impact the sgdisk utility of GPT fdisk. Exploitation requires the use of a maliciously formatted storage device and could cause sgdisk to crash as well as possibly allow for local privilege escalation...

VulnCheck KEV: CVE-2019-7193

QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system...

QNAP NAS 缓冲区错误漏洞

QNAP NAS is an accessible and fast storage solution from QNAP China. A security vulnerability exists in QNAP NAS that stems from a stack buffer overflow vulnerability that affects QNAP NAS running the Multimedia Console and can be exploited by an attacker to execute arbitrary code...

Dell EMC PowerStore OS Command Injection Vulnerability

Dell EMC PowerStore is a storage device from Dell Dell, Inc. Dell EMC PowerStore versions prior to 1.0.3.0.5.006 have an operating system command injection vulnerability that can be exploited by a locally authenticated attacker to execute arbitrary OS commands on the underlying PowerStore operati...

CVE-2020-13799

CVE-2020-13799 describes a vulnerability in the Replay Protected Memory Block (RPMB) protocol used by storage interfaces (eMMC/UFS/NVMe). The issue arises when an attacker can affect the RPMB state without the knowledge of the trusted component that uses RPMB, across multiple standards, potential...

CVE-2019-15959

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit...

CVE-2019-15959 Cisco Small Business SPA500 Series IP Phones Local Script Execution Vulnerability

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit...

CVE-2019-15959

The Cisco Small Business SPA500 Series IP Phones vulnerability (CVE-2019-15959) concerns local script execution via the device’s USB interface due to preinstalled development/testing scripts. A physically proximate attacker could insert a USB storage device to run scripts with elevated privileges...

Command Execution Vulnerability in D-Link ShareCenter DNS-320 and ShareCenter DNS-325

D-Link ShareCenter DNS-320 is a Gigabit network storage device from Taiwan AUO Group.D-Link ShareCenter DNS-325 is a network storage device from Taiwan AUO Group. A command execution vulnerability exists in the D-Link ShareCenter DNS-320 and ShareCenter DNS-325. An attacker can exploit the...

Cisco Small Business SPA500 Series IP Phones Local Script Execution Vulnerability

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit...

CVE-2019-1923

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by...

Input validation

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by...

CVE-2019-1923 Cisco Small Business SPA500 Series IP Phones Local Command Execution Vulnerability

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by...

CVE-2019-1923 Cisco Small Business SPA500 Series IP Phones Local Command Execution Vulnerability

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by...