DrayTek Vigor 3910 安全漏洞

The DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek China. A security vulnerability exists in the DrayTek Vigor 3910 version 4.3.2.6 and earlier versions, which stems from the CGI endpoints v2x00.cgi and cgiwcg.cgi being susceptible to buffer overflows from...

CVE-2024-41588: Buffer Copy without Checking Size of Input

The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strncpy function...

CVE-2024-41596: Buffer Copy without Checking Size of Input

Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 in the Vigor management UI because of improper retrieval and handling of the CGI form parameters...

CVE-2024-41590

The DrayTek Vigor310 router, in versions up to 4.3.2.6 , is susceptible to a stack-based buffer overflow vulnerability in its web interface. The root cause is a missing bounds check on parameters passed through POST requests to the strcpy function across several CGI endpoints . An authenticated u...

CVE-2024-41590: Stack-based Buffer Overflow

Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6...

PHP 8.2.x < 8.2.24 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.30, 8.2.x prior to 8.2.24, or 8.3.x prior to 8.3.12. It is, therefore, affected by multiple vulnerabilities: - Parameter injection vulnerability with a bypass of CVE-2024-4577...

CVE-2024-41596

Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 in the Vigor management UI because of improper retrieval and handling of the CGI form parameters...

PHP 8.1.x < 8.1.30 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.30, 8.2.x prior to 8.2.24, or 8.3.x prior to 8.3.12. It is, therefore, affected by multiple vulnerabilities: - Parameter injection vulnerability with a bypass of CVE-2024-4577...

[SECURITY] Fedora 40 Update: php-8.3.12-1.fc40

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

[SECURITY] Fedora 41 Update: php-8.3.12-1.fc41

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

PT-2024-7440

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor310 devices through 4.3.2.6 Description: The issue is related to a buffer overflow in the web interface of DrayTek Vigor router firmware, allowing a remote attacker to change settings or cause a denial of service. This is due to...

PT-2024-7431 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3910 versions through 4.3.2.6 Description: The issue is related to a buffer overflow vulnerability in the /cgi-bin/v2x00.cgi and /cgi-bin/cgiwcg.cgi CGI endpoints of the DrayTek Vigor3910 devices' web interface. This vulnerabilit...

PT-2024-7429 · Draytek · Draytek Vigor310

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor310 versions through 4.3.2.6 Description: The issue is related to a stack-based Buffer Overflow vulnerability in the /cgi-bin/ipfedr.cgi component of the DrayTek Vigor310 devices' web interface. This vulnerability can be exploite...

PT-2024-7433 · Draytek · Draytek Vigor310

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor310 versions up to 4.3.2.6 Description: The issue is related to a buffer overflow vulnerability in the web interface of DrayTek Vigor routers, caused by a lack of size checking on input data. This can be exploited by a remote...

The vulnerability of the CGI function in D-Link router microprogramming devices such as DI-7003GV2, DI-7100G+V2, DI-7100GV2, DI-7200GV2, DI-7300G+V2, and DI-7400G+V2 allows attackers to execute arbitrary commands.

The vulnerability of the CGI function in D-Link router microprogramming devices such as DI-7003GV2, DI-7100G+V2, DI-7100GV2, DI-7200GV2, DI-7300G+V2, and DI-7400G+V2 lies in insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a remote attacker to execute...

Fedora: Security Advisory (FEDORA-2024-2b429e720e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 40 : php (2024-2b429e720e)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2b429e720e advisory. PHP version 8.3.12 26 Sep 2024 CGI: Fixed bug GHSA-p99j-rfp4-xqvq Bypass of CVE-2024-4577, Parameter Injection Vulnerability. CVE-2024-8926 nielsdos...

The vulnerability of the `cgi.force_redirect` script in the PHP programming language allows attackers to circumvent existing security restrictions.

The vulnerability of the cgi.forceredirect script in the PHP programming language is related to security configuration errors. Exploiting this vulnerability allows an attacker to bypass existing security restrictions and execute arbitrary commands...

The vulnerability of the cgi_set_cover() function (/cgi-bin/photocenter_mgr.cgi) in the microprogramming software of D-Link devices such as DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 allows a hacker to execute arbitrary commands.

The vulnerability of the cgisetcover function /cgi-bin/photocentermgr.cgi in the microprogramming software of D-Link devices such as DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4,...

The vulnerability of the cgi_FMT_Std2R1_DiskMGR() function (/cgi-bin/hd_config.cgi) in the D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 devices allows a hacker to execute arbitrary commands.

The vulnerability of the cgiFMTStd2R1DiskMGR function /cgi-bin/hdconfig.cgi in the D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04...