‼ CVE-2022-1160 ‼
📖 Read
via "National Vulnerability Database".
heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.📖 Read
via "National Vulnerability Database".
🕴 CISA, DOE Warn of Attacks on Uninterruptible Power Supply (UPS) Devices 🕴
📖 Read
via "Dark Reading".
Take UPS management interfaces off the Internet "immediately," agencies say.📖 Read
via "Dark Reading".
Dark Reading
CISA, DOE Warn of Attacks on Uninterruptible Power Supply (UPS) Devices
Take UPS management interfaces off the Internet "immediately," agencies say.
‼ CVE-2019-12266 ‼
📖 Read
via "National Vulnerability Database".
Stack-based Buffer Overflow vulnerability in Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to run arbitrary code on the affected device. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v3 versions prior to 4.36.8.32.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40645 ‼
📖 Read
via "National Vulnerability Database".
An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the FlowTaskController.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40644 ‼
📖 Read
via "National Vulnerability Database".
An SQL Injection vulnerability exists in oasys oa_system as of 9/7/2021 in resources/mappers/notice-mapper.xml.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24763 ‼
📖 Read
via "National Vulnerability Database".
PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-9564 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the authentication logic of Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to bypass login and control the devices. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v3 versions prior to 4.36.8.32.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45031 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in MEPSAN's USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords.📖 Read
via "National Vulnerability Database".
🕴 Zero-Day Vulnerability Discovered in Java Spring Framework 🕴
📖 Read
via "Dark Reading".
A proof-of-concept exploit allows remote compromises of Spring Web applications.📖 Read
via "Dark Reading".
Dark Reading
Zero-Day Vulnerability Discovered in Java Spring Framework
A proof-of-concept exploit allows remote compromises of Spring Web applications.
‼ CVE-2022-24790 ‼
📖 Read
via "National Vulnerability Database".
Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46008 ‼
📖 Read
via "National Vulnerability Database".
In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware. An attacker, who has connected to the Wi-Fi, can easily telnet into the target with root shell if the telnet is function turned on.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46010 ‼
📖 Read
via "National Vulnerability Database".
Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a valid session and conduct further malicious operations.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43664 ‼
📖 Read
via "National Vulnerability Database".
totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component process forceugpo.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46006 ‼
📖 Read
via "National Vulnerability Database".
In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43142 ‼
📖 Read
via "National Vulnerability Database".
An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33208 ‼
📖 Read
via "National Vulnerability Database".
The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38362 ‼
📖 Read
via "National Vulnerability Database".
In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to an Insecure Direct Object Reference (IDOR) issue and retrieve sensitive data.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26644 ‼
📖 Read
via "National Vulnerability Database".
Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25008 ‼
📖 Read
via "National Vulnerability Database".
totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an authentication mechanism.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45900 ‼
📖 Read
via "National Vulnerability Database".
Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a VIVOH_AUTH cookie is assigned so that they can be uniquely identified. Certain APIs can be successfully executed without proper authentication. This can let an attacker impersonate as victim and make state changing requests on their behalf.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33523 ‼
📖 Read
via "National Vulnerability Database".
MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can execute arbitrary commands on the underlying host. This occurs in com.idsscheer.ppmmashup.business.jdbc.DriverUploadController.📖 Read
via "National Vulnerability Database".