CVE-2022-24931

The CVE-2022-24931 entry pertains to Samsung ApkInstaller’s dynamic receiver with improper access control. Connected sources (PT-2022-16993) confirm the root cause as lack of proper permission enforcement, allowing unauthorized attackers to execute arbitrary activities on affected ApkInstaller ve...

Samsung Video Player 安全漏洞

Samsung Video Player is a built-in system video player application optimized for the Samsung Galaxy series from Samsung South Korea. A privilege mismanagement vulnerability exists in Samsung Video Player versions prior to 7.3.15.30, which stems from Samsung Video Player's faulty privilege...

CVE-2021-45460

Summary of CVE-2021-45460 (Siemens SICAM PQ Analyzer): Affects all SICAM PQ Analyzer versions prior to 3.18. The flaw is an unquoted registry entry for a service with spaces in its path, enabling an attacker with write access to plant an executable that runs in place of the legitimate process. Po...

Code injection

A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1, FortiOS 6.4.x before 6.4.7 allows attacker to Execute unauthorized code or commands via specific hex read/write operations...

Code injection

An untrusted search path in AMD Radeon settings Installer may lead to a privilege escalation or unauthorized code execution...

Code injection

HP has identified a security vulnerability with the I.R.I.S. OCR Optical Character Recognition software available with HP PageWide and OfficeJet printer software installations that could potentially allow unauthorized local code execution...

CVE-2021-28493

In Arista's MOS Metamako Operating System software which is supported on the 7130 product line, under certain conditions, a user may be able to execute commands despite not having the privileges to do so. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train...

CVE-2021-35508

NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged user account. To exploit this, a low-privileged user must change the service configuration or overwrite the binary service...

Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte

✍️ Description Reflected XSS in POST /admin/scripts/pi-hole/php/customcname.php 🕵️‍♂️ Proof of Concept 1. Login as admin, Go to Local DNS - CNAME Records - Add a new CNAME record 2. Input alert1 in domain field and anything in target domain. 3. The Payload in post body domain is URL encoded, use a...

CVE-2020-20642

Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...

Security Bulletin: A vulnerable issue affects IBM Spectrum LSF Suite, IBM Spectrum LSF and IBM Spectrum LSF Suite Community Edition

Summary There is a vulnerable issue in LSF that an attacker can exploit an authentication weakness in some messages transferred between some binaries through network, to run commands with unauthorized permission. LSF have addressed this security issue CVE-2020-4983. Vulnerability Details Refer to...

Input validation

An improper input validation vulnerability of ZOOK software remote administration tool could allow a remote attacker to create arbitrary file. The ZOOK viewer has the "Tight file CMD" function to create file. An attacker could create and execute arbitrary file in the ZOOK agent program using "Tig...

Authorization

SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRMRFCSUBMITREPORT which fails to validate authorization of an authenticated user thus allowing an unauthorized user to execute reports in SAP NetWeaver AB...

XWiki Script Injection Vulnerability (GHSA-h353-hc43-95vc)

XWiki is prone to a script injection vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...

CVE-2021-21423

projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type including any project type...

CVE-2021-21379

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the wikimacrocontent executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inje...

CVE-2019-18629

Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow an attacker to execute an unwanted binary during a exploited clone install. This requires creating a clone file and signing that file with a...

CVE-2019-18629

Summary: CVE-2019-18629 affects Xerox AltaLink printers (models B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070). The issue exists in software releases before 101.00x.099.28200. An attacker can trigger execution of an unwanted binary during a clone installation by creating a clone...

CVE-2019-18629

Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow an attacker to execute an unwanted binary during a exploited clone install. This requires creating a clone file and signing that file with a...

DSL-2888A Firmware Command Injection Vulnerability

The D-link DSL-2888A is a Unified Services Router from China AUO D-link. A command injection vulnerability exists in the D-Link DVA-2800 and DSL-2888A firmware, which arises from a network system or product that does not properly filter specific elements of externally inputted data during the...