CVE-2022-32534

CVE-2022-32534 affects Bosch PRA-ES8P2S Ethernet switch (firmware 1.01.05 and earlier). The connected sources confirm a remote command-injection vulnerability in the diagnostics web interface caused by insufficient input validation, allowing an attacker to execute arbitrary OS commands via the we...

CVE-2022-32536 Privilege Escalation

The user access rights validation in the web server of the Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 was insufficient. This would allow a non-administrator user to obtain administrator user access rights...

CVE-2022-32535

The CVE describes a privilege-escalation issue in Bosch’s PRA-ES8P2S Ethernet switch running web server on firmware 1.01.05, where the web server operates with root privileges. In combination with CVE-2022-23534, this could allow an attacker to gain root access to the device. Documents confirm af...

CVE-2022-32535 Web server runs as root

The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 runs its web server with root privilege. In combination with CVE-2022-23534 this could give an attacker root access to the switch...

CVE-2022-32535: Execution with Unnecessary Privileges

The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 runs its web server with root privilege. In combination with CVE-2022-23534 this could give an attacker root access to the switch...

CVE-2022-32534: Improper Input Validation

The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web interface. This allows execution of shell commands...

CVE-2022-32536: Improper Privilege Management

The user access rights validation in the web server of the Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 was insufficient. This would allow a non-administrator user to obtain administrator user access rights...

CVE-2022-31277

Xiaomi Lamp 1 v2.0.40066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain control of the switch and other functions via a crafted POST request...

CVE-2022-31277

Xiaomi Lamp 1 v2.0.40066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain control of the switch and other functions via a crafted POST request...

PT-2025-8267

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.18.0-rc7+ Description The issue is related to the Linux kernel, specifically with the mlx5 get next phys dev function, which was called without holding the interface lock. This problem was identified when a...

PT-2022-3526

Name of the Vulnerable Software and Affected Versions Bosch Ethernet switch PRA-ES8P2S version 1.01.05 Description The issue is related to insufficient access control in the software of the Bosch Ethernet switch PRA-ES8P2S. This could allow a remote attacker to bypass existing security restrictio...

PT-2022-3525

Name of the Vulnerable Software and Affected Versions Bosch Ethernet switch PRA-ES8P2S version 1.01.05 Description The issue is related to insufficient user access rights validation in the web server, allowing a non-administrator user to obtain administrator user access rights. This could be...

CVE-2022-31484 User Account Deletion Unauthenticated

An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The impact of...

Security Bulletin: IBM Flex System switch firmware products are affected by a vulnerability in glibc (CVE-2021-35942)

Summary The following vulnerability in glibc has been addressed by IBM Flex System switch firmware products. Vulnerability Details CVEID:CVE-2021-35942 DESCRIPTION: GNU C Library aka glibc could allow a local attacker to obtain sensitive information, caused by a flaw when called with an untrusted...

DEBIAN-CVE-2022-31002

Sofia-SIP is an open-source Session Initiation Protocol SIP User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause a crash. This type of crash may be caused by a URL ending with %. Version 1.13.8 contains a patch for this issue...

Use of Uninitialized Function Pointer

Description When providing a crafted input binary to radare2, the context-readaddr function pointer is never initialized before use. This is due to the switch statement responsible for the assignment not finding a matching value for its switch cases. Calling function c static bool...

CVE-2022-22787

The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server whe...

Cross site request forgery (csrf)

The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server whe...

CVE-2022-22787

CVE-2022-22787 affects the Zoom Client for Meetings on Android, iOS, Linux, macOS and Windows, prior to version 5.10.0. The root cause is improper hostname validation during a server switch request, which could allow a malicious server to impersonate a legitimate Zoom server and lure the client d...

Zoom Client Trust Management Vulnerability

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. A trust management issue vulnerability exists in Zoom Client for Meetings prior to version 5.10.0, which stems from the application's inability to properly validate hostnames during a server...