RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a type confusion between IPv6 extension headers and a UDP header. This occurs while encoding a 6LoWPAN IPHC header. The type confusion manifests in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting
A post-authentication command injection vulnerability in the “account_operator.cgi� CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify device configuration data, resulting in denial-of-service (DoS) conditions on an affected device.
A path traversal vulnerability in the “account_print.cgi� CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privileges to execute unauthorized OS commands in the “tmp� directory by uploading a crafted file if the hotspot function were enabled.
A buffer overflow vulnerability in the “fbwifi_forward.cgi� CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.30 through 5.35, USG20(W)-VPN firmware versions 4.30 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote unauthenticated attacker to cause DoS conditions by sending a crafted HTTP request if the Facebook WiFi function were enabled on an affected device.
The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails to properly sanitize user input. A remote unauthenticated attacker could leverage the vulnerability to modify device configuration data, resulting in DoS conditions on an affected device if the attacker could…
A buffer overflow vulnerability in the “sdwan_iface_ipcâ€� binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN firmware versions 5.10 through 5.32, and VPN series firmware versions 5.00 through 5.35, which could allow a remote unauthenticated attacker to cause a core dump with a request error message on a vulnerable device by uploading a…
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Shareaholic Similar Posts plugin <=Â 3.1.6 versions.
Терраформирование – одна из самых долговечных (но не самых древних) идей в научной фантастике. Не подвергается сомнению, что скалистые планеты у других звёзд обживаемы, при условии, что на них есть гидросфера и атмосфера, и залог колонизации этих миров – приближение их…
Команда и мудрость (оно же знания, помноженные на опыт) – две основные составляющие и результата в проектах и эффективности работы структурных подразделений. Я руководитель и у меня есть своя команда и каждый ее член обладает навыками и скиллами, поделившись которыми с…
Laravel – один из наиболее популярных фреймворков для разработки на языке PHP. Если вы только начинаете свой путь в Laravel и хотите освоить этот мощный инструмент, то курс LaraКурс на YouTube может стать отличным помощником для вас. Курс разработан специально для разработчиков, которые не…