CWE-561

Vasion Print (dawniej PrinterLogic) Virtual Appliance zawiera martwy kod PHP w wielu kontenerach Docker, w tym niezabezpieczony endpoint resetroot.php oraz podatny wzorzec deserializacji. Atakujący bez żadnego uwierzytelnienia może zresetować hasło administratora bazy danych, a w połączeniu z podatnością deserializacji uzyskać pełny dostęp do systemu poprzez RCE.

Dead Code vulnerability in Mitsubishi Electric GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, Mitsubishi Electric Iconics Digital Solutions GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, Mitsubishi Electric ICONICS Suite Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, and Mitsubishi Electric Iconics Digital Solutions ICONICS Suite Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3 allows a local authenticated attacker to execute a malicious code by tampering with a specially crafted DLL. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a denial of service (DoS) condition on the products.

Juniper Networks Contrail Service Orchestration releases prior to 4.0.0 have Grafana service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Grafana or exploit other weaknesses or vulnerabilities in Grafana.

In huge memory get unmapped area check, code can never be reached because of a logical contradiction.

Unprotected dynamic receiver in Wearable Manager Service prior to SMR Jul-2022 Release 1 allows attacker to launch arbitray activity and access senstive information.

Unprotected dynamic receiver in Samsung Members prior to version 4.2.005 allows attacker to launch arbitrary activity.

Unprotected dynamic receiver in Samsung Galaxy Friends prior to SMR Aug-2022 Release 1 allows attacker to launch activity.

Intent redirection vulnerability in Bixby Voice prior to version 3.1.12 allows attacker to access contacts.

Uszkodzony bounds check w unmarshaller RPC Spotlight w Netatalk 3.0.0 przez 4.4.2 powoduje niedostępną ścieżkę kodu, która nie zapewnia efektywnej ochrony granic. Może to pozwolić zdalnemu uwierzytelnionemu atakującemu na uzyskanie ograniczonych informacji poprzez crafted Spotlight RPC requests.