‼ CVE-2021-32503 ‼
📖 Read
via "National Vulnerability Database".
Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensitive information’s to launch further attacks on the system.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2021-32974 ‼
📖 Read
via "National Vulnerability Database".
Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32976 ‼
📖 Read
via "National Vulnerability Database".
Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28355 ‼
📖 Read
via "National Vulnerability Database".
randomUUID in Scala.js before 1.10.0 generates predictable values.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28356 ‼
📖 Read
via "National Vulnerability Database".
In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28376 ‼
📖 Read
via "National Vulnerability Database".
Verizon LVSKIHP 5G outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, e.g., at the 10.0.0.1 IP address. The password (for the verizon username) is calculated by concatenating the serial number and the model (i.e., the LVSKIHP string), running the sha256sum program, and extracting the first seven characters concatenated with the last seven characters of that SHA-256 value.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28368 ‼
📖 Read
via "National Vulnerability Database".
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28381 ‼
📖 Read
via "National Vulnerability Database".
Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0405 ‼
📖 Read
via "National Vulnerability Database".
Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0406 ‼
📖 Read
via "National Vulnerability Database".
Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28379 ‼
📖 Read
via "National Vulnerability Database".
jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28380 ‼
📖 Read
via "National Vulnerability Database".
The rc-httpd component through 2022-03-31 for 9front (Plan 9 fork) allows ..%2f directory traversal if serve-static is used.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30061 ‼
📖 Read
via "National Vulnerability Database".
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, physically proximate attackers can execute code via a crafted file on a USB stick.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27248 ‼
📖 Read
via "National Vulnerability Database".
A directory traversal vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to download arbitrary .dwg files from a remote server by specifying an absolute or relative path when invoking the affected DownloadDwg endpoint. An attack uses the path field to CaddemServiceJS/CaddemService.svc/rest/DownloadDwg.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30062 ‼
📖 Read
via "National Vulnerability Database".
On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino Xenon Security Appliance, crafted OPC packets can bypass the OPC enforcer.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30064 ‼
📖 Read
via "National Vulnerability Database".
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an SSH login can succeed with hardcoded default credentials (if the device is in the uncommissioned state).📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30065 ‼
📖 Read
via "National Vulnerability Database".
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, crafted ModBus packets can bypass the ModBus enforcer. NOTE: this issue exists because of an incomplete fix of CVE-2017-11401.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26530 ‼
📖 Read
via "National Vulnerability Database".
swaylock before 1.6 allows attackers to trigger a crash and achieve unlocked access to a Wayland compositor.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27249 ‼
📖 Read
via "National Vulnerability Database".
An unrestricted file upload vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to execute arbitrary code by using UploadDwg to upload a crafted aspx file to the web root, and then visiting the URL for this aspx resource.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30066 ‼
📖 Read
via "National Vulnerability Database".
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware signature verification (for a USB stick) can be bypassed. NOTE: this issue exists because of an incomplete fix of CVE-2017-11400.📖 Read
via "National Vulnerability Database".