CVE Vulnerability Catalog

NetMan 204 nie wymusza uwierzytelniania na swoich stronach administracyjnych i punktach końcowych komend. Zdalny, nieautoryzowany atakujący może bezpośrednio żądać stron administracyjnych, co prowadzi do ujawnienia wrażliwych informacji oraz możliwości wywołania uprzywilejowanych komend kontrolnych UPS.

NetMan 204 zawiera twardo zakodowane konto backdoor z nazwą użytkownika i hasłem 'eurek', które przyznaje dostęp administracyjny. Zdalny, nieautoryzowany atakujący może uwierzytelnić się przez punkt końcowy cgi-bin/login.cgi, co pozwala na uzyskanie uprawnień administratora.

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections due to improper input sanitization. The send_stats method does not remove newlines from metric names, allowing attackers to change the metric name prefix.

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. The format_event method does not validate the content of the tags, allowing data injection from untrusted sources.

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders but only allocates three characters per binder in the buffer.

DTS Electronics Redline WR3200 router has an improper authentication vulnerability for critical functions, allowing attackers to access functionality not properly constrained by ACLs. Affects versions from 7.1.3 before 7.1.8.

The Product Slider Pro for WooCommerce plugin for WordPress before version 3.5.4 has an improper validation of specified quantity in input vulnerability, allowing malicious software implantation.

A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon frame containing a malformed Traffic Indication Map (TIM) Information Element. The function morse_page_slicing_process_tim_element() in page_slicing.c derives the TIM bitmap length directly from a received IE field without validating it against the fixed-size destination buffer before passing it to memset and memcpy operations, allowing up to 252 bytes of attacker-controlled data to be written beyond the buffer boundary. Because beacons are broadcast frames processed during passive scanning, no authentication, association, or user interaction is required.

The HaLow Wi-Fi kernel driver (dot11ah.ko) in Morse Micro HaLowLink 2 software before version 2.11.13 contains a heap-based buffer overflow that can be exploited by an unauthenticated attacker within radio range to cause a kernel panic or remote code execution via a crafted beacon or probe response frame.

Use after free in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

Insufficient policy enforcement in the Sandbox component of Google Chrome on Linux prior to 149.0.7827.53 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium severity: Low.

Inappropriate implementation in DevTools of Google Chrome prior to 149.0.7827.53 allows a remote attacker who has compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium severity: Low.

Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.

An authentication bypass by spoofing vulnerability in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network.

Insufficient validation of untrusted input in Reading Mode in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Insufficient validation of untrusted input in Autofill in Google Chrome prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via malicious network traffic.

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted video file.

In Google Chrome on Android prior to 149.0.7827.53, an inappropriate implementation in WebView allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

In Google Chrome on iOS prior to 149.0.7827.53, a use-after-free in WebMIDI allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.