product: CPG BIOS

less_than: All

summary: Dell BIOS versions contain an Improper Authentication vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls.


vendor: Dell

status: affected

version: unspecified

version_type: custom

ecosystem: operating-system

metric_type: Primary

severity: high

metric_type: Secondary

severity: medium

part: o

vendor: dell

quality: metadata-backed

recipe_kind: composed

status: Modified

summary: Dell BIOS contains a race condition vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI in order to bypass security checks during SMM.


summary: Dell BIOS versions contain a stack-based buffer overflow vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI to bypass security checks resulting in arbitrary code execution in SMM.


less_than: Gen7, Gen8, Gen9, Gen10, Gen11, 21Q1-Q4

summary: Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could exploit this vulnerability by sending malicious input via SMI to obtain arbitrary code execution during SMM.


summary: Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM.


title: Prior Dell BIOS versions contain an Input Validation vulnerability


product: Dell OS Recovery Tool

ecosystem: software/application

part: a

summary: Dell Support Assist OS Recovery versions before 5.5.2 contain an Authentication Bypass vulnerability. An unauthenticated attacker with physical access to the system may exploit this vulnerability by bypassing OS Recovery authentication in order to run arbitrary code on the system as Administrator.


product: PowerStore

less_than: PowerStore SW v2.1.1.0

severity: low

product: powerstoreos

summary: Dell PowerStore Versions before v2.1.1.0. contains a Stored Cross-Site Scripting vulnerability. A high privileged network attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.


summary: PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, without any validation or sanitization. It allows a malicious, authenticated user to inject payloads that might get interpreted as formulas by the corresponding spreadsheet application that is being used to open the CSV/XLSX file.


summary: Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system takeover by an attacker.


severity: critical

summary: Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure and arbitrary code execution.


summary: Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability under specific configuration. An attacker would gain unauthorized access upon successful exploit.


product: Trend Micro Apex Central

vendor: Trend Micro

version: 2019 (on-premise), SaaS

business_risk: No additional source-verified CVE-specific business impact was established.

uncertainty: The current Trend Micro support knowledge-base articles linked by NVD were unavailable during retrieval, so detailed platform-specific installation and rollback procedures could not be independently confirmed.

uncertainty: The vendor advisory identifies Build 6016 as the CVE-specific patch threshold; it does not establish that every later build is independently tested here, although later vendor updates are ordinarily preferred.

uncertainty: No safe vendor-documented endpoint or scanner procedure for validating this specific flaw was available in the retrieved sources.

uncertainty: The model did not return a fully sourced exposure, remediation, and verification set; consult the linked NVD and vendor sources before acting.

known_ransomware_campaign_use: Unknown

product: Apex Central

required_action: Apply updates per vendor instructions.

vendor_project: Trend Micro

vulnerability_name: Trend Micro Apex Central Arbitrary File Upload Vulnerability

vendor: trendmicro

status: Analyzed

summary: An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.


default_status: unaffected

product: MegaRAC SPx-12

vendor: AMI

version_type: Custom

product: MegaRAC SPx-13

default_status: unknown

vendor: ami

vendor: netapp

summary: AMI Megarac Password reset interception via API


product: Aptio

vendor: intel

summary: A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: PlatformInitAdvancedPreMem SHA256: 644044fdb8daea30a7820e0f5f88dbf5cd460af72fbf70418e9d2e47efed8d9b Module GUID: EEEE611D-F78F-4FB9-B868-55907F169280 This issue affects: AMI Aptio 5.x.


vendor: horde

vendor: debian

summary: lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.

title: Horde Horde Mime Viewer security vulnerability


product: desktop

vendor: asana

summary: Asana Desktop before 1.6.0 allows remote attackers to exfiltrate local files if they can trick the Asana desktop app into loading a malicious web page.

title: Asana Desktop security vulnerability


ecosystem: linux/kernel

vendor: linux

summary: drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed).


product: Apache DolphinScheduler

vendor: Apache Software Foundation

version: Apache DolphinScheduler

product: dolphinscheduler

vendor: apache

summary: Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.


summary: When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.


product: DIAEnergie

vendor: Delta Electronics

product: diaenergie

vendor: deltaww

summary: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_loopmapHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.


version: See references

summary: Cross-site scripting in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable information disclosure via local access.

title: Intel Quartus Prime security vulnerability


product: Splunk Enterprise

vendor: Splunk

version: Version(s) before 8.1.2

product: splunk

vendor: splunk

summary: In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page (e.g., HTML Injection, XSS) or bypass SPL safeguards for risky commands. The attack is browser-based. An attacker cannot exploit the attack at will and requires the attacker to initiate a request within the victim's browser (e.g., phishing).


product: BIG-IP Advanced WAF, ASM, and APM

status: unaffected

archetype: generic

summary: On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Session Awareness, and the "Use APM Username and Session ID" option is enabled, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

title: F5 Big-Ip Access Policy Manager security vulnerability


product: Microsoft Edge (Chromium-based)

vendor: Microsoft

ecosystem: windows/system

vendor: microsoft

summary: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability


title: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability


product: Azure Site Recovery VMWare to Azure

summary: Azure Site Recovery Information Disclosure Vulnerability


title: Azure Site Recovery Information Disclosure Vulnerability


summary: Azure Site Recovery Remote Code Execution Vulnerability


product: Microsoft Office 2019 for Mac

product: Microsoft Office Online Server

platforms:
32-bit Systems
x64-based Systems

product: Microsoft 365 Apps for Enterprise

product: Microsoft Office LTSC for Mac 2021

platforms:
x64-based Systems
32-bit Systems

product: Microsoft Office LTSC 2021

product: Microsoft Excel 2016

product: Microsoft Office 2016

platforms:
ARM64-based Systems
32-bit Systems
x64-based Systems

product: Microsoft Excel 2013 Service Pack 1

product: Microsoft Office 2013 Service Pack 1

product: Microsoft Office Web Apps Server 2013 Service Pack 1

product: excel

product: office

summary: Microsoft Excel Remote Code Execution Vulnerability


platforms:
32-bit Systems
x64-based Systems
ARM64-based Systems

product: Windows 10 Version 1809

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Windows 10 Version 1909

platforms:
x64-based Systems
ARM64-based Systems
32-bit Systems

product: Windows 10 Version 21H1

product: Windows Server 2022

platforms:
32-bit Systems
ARM64-based Systems

product: Windows 10 Version 20H2

product: Windows Server version 20H2

platforms:
32-bit Systems
ARM64-based Systems
x64-based Systems

product: Windows 10 Version 21H2

product: Windows 10 Version 1507

product: Windows 10 Version 1607

product: Windows Server 2016

product: powerpoint

product: word

summary: Windows Graphics Component Remote Code Execution Vulnerability


platforms:
x64-based Systems
ARM64-based Systems

product: Windows 11 version 21H2

product: Windows

vendor_project: Microsoft

vulnerability_name: Microsoft Windows User Profile Service Privilege Escalation Vulnerability

summary: Windows User Profile Service Elevation of Privilege Vulnerability


product: Microsoft Edge (Chromium-based)

summary: Microsoft Edge (Chromium-based) Spoofing Vulnerability


product: Azure SDK for .Net

summary: Azure SDK for .NET Information Disclosure Vulnerability


product: Skype for Business Server 2015 CU12

product: Skype for Business Server 2019 CU6

summary: Skype for Business and Lync Spoofing Vulnerability


product: Microsoft Lync Server 2013 CU10

summary: Skype for Business Information Disclosure Vulnerability


product: Windows 10 Version 1809

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Windows 10 Version 1909

product: Windows 10 Version 21H1

summary: Windows Authentication Information Disclosure Vulnerability


product: Windows Server 2022

product: Windows 10 Version 20H2

product: Windows Server version 20H2

product: Windows 10 Version 21H2

summary: Win32k Elevation of Privilege Vulnerability


product: Windows 10 Version 1507

product: Windows 10 Version 1607

summary: Windows Secure Channel Denial of Service Vulnerability


product: Windows 11 version 21H2

summary: Windows Fax Compose Form Remote Code Execution Vulnerability


title: Windows Fax Compose Form Remote Code Execution Vulnerability


summary: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability


summary: Windows Graphics Component Information Disclosure Vulnerability


product: Visual Studio Code

summary: Visual Studio Code Elevation of Privilege Vulnerability


product: Active Directory

vulnerability_name: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

summary: Active Directory Domain Services Elevation of Privilege Vulnerability


product: YARP 1.0

product: YARP 1.1RC

summary: YARP Denial of Service Vulnerability

title: YARP Denial of Service Vulnerability


notes: WARNING: This update is required on all Microsoft Windows endpoints but if deployed to domain controllers without additional configuration changes the update breaks PIV/CAC authentication. Read CISA implementation guidance carefully before deploying to domain controllers.;  https://nvd.nist.gov/vuln/detail/CVE-2022-26925

product: Windows

required_action: Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].

vulnerability_name: Microsoft Windows LSA Spoofing Vulnerability

summary: Windows LSA Spoofing Vulnerability


product: Windows 10 Version 1809

summary: Windows Address Book Remote Code Execution Vulnerability


product: Windows Server 2019

title: Windows Graphics Component Remote Code Execution Vulnerability


product: Windows Server 2019 (Server Core installation)

product: Windows 10 Version 22H2

product: Windows Server 2016

summary: Windows Photo Import API Elevation of Privilege Vulnerability


platforms: Windows Server 2022 (Server Core installation)

platforms: Windows 11 version 21H2 for x64-based Systems

platforms: Windows 11 version 21H2 for ARM64-based Systems

product: Microsoft .NET Framework 3.5 AND 4.8.1

platforms: Windows 10 Version 21H1 for 32-bit Systems

platforms: Windows 10 Version 21H1 for x64-based Systems

platforms: Windows 10 Version 21H2 for 32-bit Systems

platforms: Windows 10 Version 21H2 for ARM64-based Systems

platforms: Windows 10 Version 21H1 for ARM64-based Systems

platforms: Windows 10 Version 21H2 for x64-based Systems

product: Microsoft .NET Framework 4.8.1

platforms:
Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems

product: Microsoft .NET Framework 3.5 AND 4.6/4.6.2

summary: .NET Framework Remote Code Execution Vulnerability


product: Windows 10 Version 1909

product: Windows 10 Version 21H1

product: Windows Server 2022

product: Windows 10 Version 20H2

product: Windows Server version 20H2

product: Windows 10 Version 21H2

platforms:
32-bit Systems
x64-based Systems

summary: Windows Remote Access Connection Manager Information Disclosure Vulnerability


product: Windows 11 version 21H2

product: Windows 10 Version 1507

product: Windows 10 Version 1607

summary: Windows Kerberos Elevation of Privilege Vulnerability


product: Windows Server 2016 (Server Core installation)

summary: Storage Spaces Direct Elevation of Privilege Vulnerability


product: Windows 10 Version 1809

product: Windows Server 2019

summary: Windows NTFS Information Disclosure Vulnerability


product: Windows Server 2019 (Server Core installation)

product: office

title: Windows Graphics Component Information Disclosure Vulnerability


summary: Windows WLAN AutoConfig Service Information Disclosure Vulnerability


summary: Windows Server Service Information Disclosure Vulnerability


product: Windows Server 2016

product: Windows Server 2008 Service Pack 2

product: Windows Server 2008 Service Pack 2 (Server Core installation)

product: Windows Server 2008 R2 Service Pack 1

product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

summary: Windows Network File System Remote Code Execution Vulnerability


product: Windows Server 2022

product: Windows Server version 20H2

title: Storage Spaces Direct Elevation of Privilege Vulnerability


product: Remote Desktop client for Windows Desktop

product: Windows 11 version 21H2

summary: Remote Desktop Protocol Client Information Disclosure Vulnerability


product: Mobile Radio

vendor: Motorola

vendor: motorola

summary: A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitrary code execution inside the teds_app binary, which runs with root privileges.


summary: The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives.


summary: The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottime entropy and limited re-seeding of the pool renders the authentication challenge vulnerable to two attacks. First, due to the limited boottime pool entropy, an adversary can derive the contents of the entropy pool by an exhaustive search of possible values, based on an observed authentication challenge. Second, an adversary can use knowledge of the entropy pool to predict authentication challenges. As such, the unit is vulnerable to CVE-2022-24400.

title: Motorola Mtm5500 Firmware security vulnerability


product: xtrabackup

vendor: percona

summary: Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table. NOTE: this issue exists because of an incomplete fix for CVE-2020-10997.


product: go-getter

vendor: hashicorp

summary: go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

title: Hashicorp Go-Getter security vulnerability


ecosystem: javascript/npm

product: archer

vendor: rsa

summary: Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and gets executed by the web browser in the context of the vulnerable web application.


summary: The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability. A malicious attacker may obtain access to credential information to use it in further attacks.


summary: Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper access control vulnerability on attachments. A remote authenticated malicious user could potentially exploit this vulnerability to gain access to files that should only be allowed by extra privileges.


summary: Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the Archer application without the victims realizing an attack occurred.


summary: Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and gets executed by the web browser in the context of the vulnerable web application.


vendor: digi

summary: Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is redirected to the authentication page.

title: Digi Passport Firmware security vulnerability


summary: Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow. An attacker can supply a string in the page parameter for reboot.asp endpoint, allowing him to force an overflow when the string is concatenated to the HTML body.


product: nopcommerce

vendor: nopcommerce

summary: Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter, processed by the (1) ChangePassword function, (2) SignInCustomerAsync function, (3) SuccessfulAuthentication method, or (4) NopRedirectResultExecutor class.

title: Nopcommerce security vulnerability


vendor: globalnorthstar

summary: There are two full (read/write) Blind/Time-based SQL injection vulnerabilities in the Northstar Club Management version 6.3 application. The vulnerabilities exist in the userName parameter of the processlogin.jsp page in the /northstar/Portal/ directory and the userID parameter of the login.jsp page in the /northstar/iphone/ directory. Exploitation of the SQL injection vulnerabilities allows full access to the database which contains critical data for organization’s that make full use of the software suite.


product: elfinder

summary: connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.


vendor: devolutions

summary: Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-force attack. An error caused base64 to be decoded.

title: Devolutions Remote Desktop Manager security vulnerability


product: pluck

vendor: pluck-cms

summary: In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.


vendor: linux

vendor: netapp

vendor: debian

summary: An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device.


product: gpac

vendor: gpac

summary: GPAC 2.0 allows a heap-based buffer overflow in gf_base64_encode. It can be triggered via MP4Box.


product: directus

vendor: monospace

summary: In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.


vendor: barco

summary: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. This upload can be executed without authentication.


summary: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /cgi-bin endpoint. The URL parameters are not correctly sanitized, leading to reflected XSS.


summary: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. By tweaking the license file name, the returned error message exposes internal directory path details.


summary: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a file upload mechanism. Lack of input sanitization in the upload mechanism leads to reflected XSS.


summary: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing log files without authentication.


summary: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanitization in the upload mechanism is leads to reflected XSS.


summary: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanitization of the upload mechanism is leads to stored XSS.


summary: Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checklogin.jsp endpoint. The os_username parameters is not correctly sanitized, leading to reflected XSS.


vendor: foxit

summary: Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow a NULL pointer dereference when this.Span is used for oState of Collab.addStateModel, because this.Span.text can be NULL.

title: Foxit Pdf Editor security vulnerability


product: teampass

vendor: teampass

summary: Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.


product: liblouis

vendor: liblouis

product: fedora

vendor: fedoraproject

product: ipados

vendor: apple

product: macos

product: tvos

product: watchos

summary: Liblouis through 3.21.0 has a buffer overflow in compilePassOpcode in compileTranslationTable.c (called, indirectly, by tools/lou_checktable.c).

title: Liblouis security vulnerability


vendor: simplemachines

summary: SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that administrators are intended to have the ability to modify themes, and can thus choose any PHP code that they wish to have executed on the server.

title: Simplemachines Simple Machines Forum security vulnerability


product: impresscms

vendor: impresscms

summary: SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.

title: Impresscms security vulnerability


vendor: tp-link

vendor: mercusys

vendor: fastcom

summary: TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MmtAtePrase` function. Local users could get remote code execution.

title: Tp-Link Tl-Wdr7660 Firmware security vulnerability


summary: TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MntAte` function. Local users could get remote code execution.


vendor: arris

summary: Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the firewall-local log function via the EmailAddress, SmtpServerName, SmtpUsername, and SmtpPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

title: Arris Sbr-Ac1900P Firmware security vulnerability


summary: Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ntp function via the TimeZone parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.


summary: Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ddns function via the DdnsUserName, DdnsHostName, and DdnsPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.


summary: Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pppoe function via the pppoeUserName, pppoePassword, and pppoe_Service parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.


summary: Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pptp function via the pptpUserName and pptpPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.


vendor: commscope

summary: Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, pptp_fix_mask, pptp_fix_gw, and wan_dns1_stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

title: Commscope Arris Tr3300 Firmware security vulnerability


summary: Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd, and pppoe_servicename parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.


summary: Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.


summary: Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.


summary: Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat, wan_mask_stat, wan_gw_stat, and wan_dns1_stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.