NewStart CGSL MAIN 6.02 : libsndfile Vulnerability (NS-SA-2022-0068)

The remote NewStart CGSL host, running version MAIN 6.02, has libsndfile packages installed that are affected by a vulnerability: - A heap buffer overflow vulnerability in msadpcmdecodeblock of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file. CVE-2021-3246 Note...

NewStart CGSL MAIN 6.02 : initscripts Vulnerability (NS-SA-2022-0069)

The remote NewStart CGSL host, running version MAIN 6.02, has initscripts packages installed that are affected by a vulnerability: - rc.sysinit in initscripts before 8.76.3-1 on Fedora 9 and other Linux platforms allows local users to delete arbitrary files via a symlink attack on a file or...

NewStart CGSL CORE 5.04 / MAIN 5.04 : lasso Vulnerability (NS-SA-2022-0011)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has lasso packages installed that are affected by a vulnerability: - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. CVE-2021-28091 Note that Nessus has not tested for this issue but ha...

NewStart CGSL MAIN 6.02 : qemu Vulnerability (NS-SA-2022-0072)

The remote NewStart CGSL host, running version MAIN 6.02, has qemu packages installed that are affected by a vulnerability: - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ipreass in ipinput.c. CVE-2019-15890 Note that Nessus has not tested for this issue but has instead relied...

NewStart CGSL CORE 5.04 / MAIN 5.04 : httpd Vulnerability (NS-SA-2022-0016)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has httpd packages installed that are affected by a vulnerability: - A crafted request uri-path can cause modproxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server...

NewStart CGSL CORE 5.05 / MAIN 5.05 : xterm Vulnerability (NS-SA-2022-0032)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has xterm packages installed that are affected by a vulnerability: - xterm before Patch 366 allows remote attackers to execute arbitrary code or cause a denial of service segmentation fault via a crafted UTF-8 combining charact...

NewStart CGSL MAIN 6.02 : NetworkManager Vulnerability (NS-SA-2022-0064)

The remote NewStart CGSL host, running version MAIN 6.02, has NetworkManager packages installed that are affected by a vulnerability: - A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this...

NewStart CGSL CORE 5.05 / MAIN 5.05 : lasso Vulnerability (NS-SA-2022-0046)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has lasso packages installed that are affected by a vulnerability: - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. CVE-2021-28091 Note that Nessus has not tested for this issue but ha...

NewStart CGSL MAIN 6.02 : sane-backends Vulnerability (NS-SA-2022-0058)

The remote NewStart CGSL host, running version MAIN 6.02, has sane-backends packages installed that are affected by a vulnerability: - A NULL pointer dereference in saneiepsonnetread in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to caus...

ZTE ZXHN F680 Cross-Site Scripting Vulnerability

ZTE ZXHN F680 is a dual-band GPON home gateway from ZTE China. A cross-site scripting vulnerability exists in the ZTE ZXHN F680 version 6.0.10p3n20, which originates from the lack of checksum filtering of user-supplied and output data in the gateway name. An authenticated attacker can exploit thi...

CVE-2022-23136

There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters and trigger an XSS attack when the user views the current topology of the device through the management page...

CVE-2022-23136

There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters and trigger an XSS attack when the user views the current topology of the device through the management page...

Cross site scripting

There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters and trigger an XSS attack when the user views the current topology of the device through the management page...

CVE-2022-23136

There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters and trigger an XSS attack when the user views the current topology of the device through the management page...

CVE-2022-23136

CVE-2022-23136 describes a stored XSS vulnerability in ZTE ZXHN F680 home gateway. The issue arises from lack of input/output validation in the gateway name, allowing an attacker to modify the gateway name and trigger XSS when users view the topology on the management page. Connected sources corr...

ZTE ZXHN F680 跨站脚本漏洞

ZTE ZXHN F680 is a dual-band GPON home gateway from ZTE China. A cross-site scripting vulnerability exists in the ZTE ZXHN F680 version 6.0.10p3n20, which originates from the lack of checksum filtering of user-supplied and output data in the gateway name. An authenticated attacker can exploit thi...

WordPress One Click Demo Import plugin <= 3.0.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by YICHENG LIU-ZTE CHENFENG lab in WordPress One Click Demo Import plugin versions = 3.0.2. Solution Update the WordPress One Click Demo Import plugin to the latest available version at least 3.1.0...

WordPress Podcast Importer SecondLine plugin <= 1.3.7 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by YICHENG LIU-ZTE CHENFENG lab in WordPress Podcast Importer SecondLine plugin versions = 1.3.7. Solution Update the WordPress Podcast Importer SecondLine plugin to the latest available version at least 1.3.8...

Deep dive: Vulnerabilities in ZTE router could lead to complete attacker control of the device

Cisco Talos’ vulnerability research team disclosed multiple vulnerabilities in the ZTE MF971R wireless hotspot and router in October. Several months removed from that disclosure and ZTE’s patch, we decided to take an even closer look at two of these vulnerabilities — CVE-2021-21748 and... This is...

ZTE Zxhn F677 Directory Traversal Vulnerability

The ZTE Zxhn F677 is a dual-band wireless router from China's ZTE ZTE. A directory traversal vulnerability exists in ZTE Zxhn F677 versions prior to 9.0.0p1n29. The vulnerability stems from the lack of validation of user-modified destination paths, which can be exploited by an attacker to modify...