1702 matches found
多款Apple产品权限许可和访问控制问题漏洞
Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. Apple iOS and iPadOS are vulnerable to a privilege-granting and access-control issue that stems from a logic issue in...
Zyxel Firewall ZTP Unauthenticated Command Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zyxel Firewall ZTP Unauthenticated Command Injection', 'Description' = %q This module exploits CVE-2022-30525, an unauthenticated remote command...
CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection
Rapid7 discovered and reported a vulnerability that affects Zyxel firewalls supporting Zero Touch Provisioning ZTP, which includes the ATP series, VPN series, and the USG FLEX series including USG20-VPN and USG20W-VPN. The vulnerability, identified as CVE-2022-30525, allows an unauthenticated and...
Zyxel Firewall ZTP Unauthenticated Command Injection
This module exploits CVE-2022-30525, an unauthenticated remote command injection vulnerability affecting Zyxel firewalls with zero touch provisioning ZTP support. By sending a malicious setWanPortSt command containing an mtu field with a crafted OS command to the /ztp/cgi-bin/handler page, an...
About the security content of iOS 15.4.1 and iPadOS 15.4.1
About the security content of iOS 15.4.1 and iPadOS 15.4.1 This document describes the security content of iOS 15.4.1 and iPadOS 15.4.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...
Juniper Junos OS Path Traversal Vulnerability
A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN DVPN, Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning ZTP allows an unauthenticated attacker to perform remote code execution...
Apple iOS和Apple iPadOS 信息泄露漏洞
Apple iOS and Apple iPadOS are products of Apple Inc.Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for iPad tablets.Apple iOS 15.4 and iPadOS 15.4 prior to Markup contain an information disclosure vulnerability that could allow an attacker with...
Apple iOS和Apple iPadOS 代码问题漏洞
Apple iOS and Apple iPadOS are products of Apple Inc.Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for the iPad tablet computer. A code issue exists in the Kernel of Apple iOS 15.4 and iPadOS prior to 15.4 where a privileged attacker may be able...
Apple iOS和Apple iPadOS 信息泄露漏洞
Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. An information disclosure vulnerability exists in the Apple iOS and iPadOS Wi-Fi module, which is caused by a malicious...
Apple iOS和Apple iPadOS 信息泄露漏洞
Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. An information disclosure vulnerability exists in Apple iOS and iPadOS WebKit, which originates from processing maliciousl...
Samsung Bixby Touch安全漏洞
An access control error vulnerability exists in Samsung Bixby Touch, a virtual intelligent assistant for Samsung mobile devices, which stems from a failure to properly restrict access to resources from unauthorized roles in Bixby Touch. An attacker could exploit the vulnerability to allow untrust...
kernel: out of bounds write in hid-multitouch.c may lead to escalation of privilege
A flaw was found in the Linux kernel’s multi-touch input system. An out-of-bounds write triggered by a use-after-free issue could lead to memory corruption or possible privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...
Apple Releases iOS, iPadOS, macOS Updates to Patch Actively Exploited Zero-Day Flaw
Apple on Thursday released security updates for iOS, iPadOS, macOS, and Safari to address a new WebKit flaw that it said may have been actively exploited in the wild, making it the company's third zero-day patch since the start of the year. Tracked as CVE-2022-22620, the issue concerns a...
CVE-2022-22809
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manner when an attacker attempts to modify the touch configurations. Affected Product: spaceLYnk V2.6.2 and prior, Wiser for KNX formerly...
Authentication flaw
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manner when an attacker attempts to modify the touch configurations. Affected Product: spaceLYnk V2.6.2 and prior, Wiser for KNX formerly...
CVE-2022-22809
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manner when an attacker attempts to modify the touch configurations. Affected Product: spaceLYnk V2.6.2 and prior, Wiser for KNX formerly...
Schneider Electric spaceLYnk 访问控制错误漏洞
The Schneider Electric spaceLYnk is a programmable logic controller from Schneider Electric France. An access control error vulnerability exists in the Schneider Electric spaceLYnk that originates when an attacker can exploit the vulnerability to attempt to modify the touch configuration, which...
CVE-2022-22809: Missing Authentication for Critical Function
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manner when an attacker attempts to modify the touch configurations. Affected Product: spaceLYnk V2.6.2 and prior, Wiser for KNX formerly...
Apple Releases iOS and macOS Updates to Patch Actively Exploited 0-Day Vulnerability
Apple on Wednesday released iOS 15.3 and macOS Monterey 12.2 with a fix for the privacy-defeating bug in Safari, as well as to contain a zero-day flaw, which it said has been exploited in the wild to break into its devices. Tracked as CVE-2022-22587, the vulnerability relates to a memory corrupti...