196 matches found
CVE-2021-43722
CVE-2021-43722 affects D-Link DIR-645 (firmware v1.03 A1). The hnap_main function in the cgibin handler uses sprintf to format the soapaction header onto the stack without size limit, causing a stack-based buffer overflow. CVSS data from NVD/OpenVAS indicate a high/critical impact when exploited ...
Pyo Buffer Overflow Vulnerability
Buffer overflow in ajaxsoundstudio.com Pyo = 1.03 in the Serverjackinit function which allows attackers to conduct Denial of Service attacks by arbitrary constructing a overlong clientname...
CVE-2021-41498
Buffer overflow in ajaxsoundstudio.com Pyo < and 1.03 in the Serverjackinit function. which allows attackers to conduct Denial of Service attacks by arbitrary constructing a overlong server name...
CVE-2021-41498
Buffer overflow in ajaxsoundstudio.com Pyo < and 1.03 in the Serverjackinit function. which allows attackers to conduct Denial of Service attacks by arbitrary constructing a overlong server name...
Buffer overflow
Buffer overflow in ajaxsoundstudio.com Pyo < and 1.03 in the Serverjackinit function. which allows attackers to conduct Denial of Service attacks by arbitrary constructing a overlong server name...
CVE-2021-41498
Buffer overflow in ajaxsoundstudio.com Pyo < and 1.03 in the Serverjackinit function. which allows attackers to conduct Denial of Service attacks by arbitrary constructing a overlong server name...
Pyo 安全漏洞
Pyo is a Python module written in C by the individual developer Olivier Belanger. It is used to help create digital signal processing scripts. ajaxsoundstudio.com A security vulnerability exists in versions of Pyo prior to 1.03, which can be exploited by an attacker to conduct a DoS attack by...
CVE-2021-36605
engineercms 1.03 is vulnerable to Cross Site Scripting XSS. There is no escaping in the nickname field on the user list page. When viewing this page, the JavaScript code will be executed in the user's browser...
CVE-2021-36605
engineercms 1.03 is vulnerable to Cross Site Scripting XSS. There is no escaping in the nickname field on the user list page. When viewing this page, the JavaScript code will be executed in the user's browser...
engineercms 跨站脚本漏洞
engineercms is an open source engineer knowledge management system . Specifically for civil engineers to create a suitable web-based knowledge management system . It can be used to manage both individual project information , but also for managing project team information ; it can run on both...
CVE-2021-36605
engineercms 1.03 is affected by a Cross-Site Scripting (XSS) vulnerability in the nickname field on the user list page due to lack of escaping. When an admin or user views the page, the embedded JavaScript can be executed in the attacker’s browser, potentially compromising user sessions or creden...
Multiple vulnerabilities in Buffalo WSR-1166DHP3 and WSR-1166DHP4 routers
Overview Buffalo WSR-1166DHP3 and WSR-1166DHP4 routers provided by Buffalo Inc. contain multiple vulnerabilities listed below. Improper access control CWE-284 - CVE-2021-20730 OS command injection CWE-78 - CVE-2021-20731 Chuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC...
Qmail SMTP 1.03 - Bash Environment Variable Injection
Exploit Title: Qmail SMTP 1.03 - Bash Environment Variable Injection Date: 2020-07-03 Exploit Author: 1F98D Original Authors: Mario Ledo, Mario Ledo, Gabriel Follon Version: Qmail 1.03 Tested on: Debian 9.11 x64 CVE: CVE-2014-6271 References: http://seclists.org/oss-sec/2014/q3/649...
PT-2020-10103 · D Link · D-Link Dsl-2680
Name of the Vulnerable Software and Affected Versions: D-Link DSL-2680 version EU 1.03 Description: A Broken Access Control issue in the web administration interface allows an attacker to download configuration settings by submitting a "rom-0" GET request without authentication on the admin...
CVE-2019-0280
CVE-2019-0280 affects SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03–6.06, 6.16–6.18, and 8.0; S4CORE 1.01–1.03). The issue is missing authorization checks on objects T_DEAL_DP and T_DEAL_PD, leading to escalation of privileges. The vulnerability is documented with HIGH impact per CVSSv3 ...
CVE-2019-9975
DASAN H660RM devices with firmware 1.03-0022 use a hard-coded key for logs encryption. Data stored using this key can be decrypted by anyone able to access this key...
CVE-2019-9976
The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-in users to read the credentials of administration web interface users...
Design/Logic Flaw
The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-in users to read the credentials of administration web interface users...
CVE-2019-9976
The CVE-2019-9976 entry documents a vulnerability in the Boa web server used on DASAN H660RM devices running firmware 1.03-0022 where POST data is logged to /tmp/boa-temp. This storage allows logged-in users to read the credentials of administration web interface users, causing a confidentiality ...
DASAN H660RM Information Disclosure / Hardcoded Key
Hi! CVE-2019-9974: diagtool.cgi on DASAN H660RM devices with firmware 1.03-0022 allows spawning ping processes without any authorization leading to information disclosure and DoS attacks Remote attacker could enumerate hosts on LAN interface sending requests to /cgi-bin/diagtool.cgi with ip...