CVE-2024-53939

An issue was discovered in Victure RX1800 WiFi 6 Router software ENV1.0.0r12110933, hardware 1.0 devices. The /cgi-bin/luci/admin/opsw/Dualfrequnapple endpoint is vulnerable to command injection through the 2.4 GHz and 5 GHz name parameters, allowing an attacker to execute arbitrary commands on t...

CVE-2024-53939: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in Victure RX1800 WiFi 6 Router software ENV1.0.0r12110933, hardware 1.0 devices. The /cgi-bin/luci/admin/opsw/Dualfrequnapple endpoint is vulnerable to command injection through the 2.4 GHz and 5 GHz name parameters, allowing an attacker to execute arbitrary commands on t...

CVE-2024-53937

The Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933 , hardware 1.0 ) is vulnerable because the TELNET service is enabled by default with admin/admin credentials and is exposed over the LAN . This allows an attacker to execute arbitrary commands with root-level permissions . Notably, d...

CVE-2024-53940

An issue was discovered in Victure RX1800 WiFi 6 Router software ENV1.0.0r12110933, hardware 1.0 devices. Certain /cgi-bin/luci/admin endpoints are vulnerable to command injection. Attackers can exploit this by sending crafted payloads through parameters intended for the ping utility, enabling...

CVE-2024-53938

The Victure RX1800 WiFi 6 Router (hardware 1.0, software EN_V1.0.0_r12_110933) is affected by a vulnerability where the TELNET service is enabled by default and exposed over the LAN. The root account is accessible without a password, enabling an unauthenticated attacker to achieve full control ov...

CVE-2024-53940

The Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933 , hardware 1.0 ) is vulnerable to command injection in certain /cgi-bin/luci/admin endpoints. Attackers can exploit this by sending crafted payloads through parameters intended for the ping utility , which allows for arbitrary comman...

CVE-2024-53937: Incorrect Authorization

An issue was discovered on Victure RX1800 WiFi 6 Router software ENV1.0.0r12110933, hardware 1.0 devices. The TELNET service is enabled by default with admin/admin as default credentials and is exposed over the LAN. The allows attackers to execute arbitrary commands with root-level permissions...

CVE-2024-53938: Missing Authorization

An issue was discovered in Victure RX1800 WiFi 6 Router software ENV1.0.0r12110933, hardware 1.0 devices. The TELNET service is enabled by default and exposed over the LAN. The root account is accessible without a password, allowing attackers to achieve full control over the router remotely witho...

CVE-2024-53941

A security vulnerability exists in the Victure RX1800 WiFi 6 Router (software version EN_V1.0.0_r12_110933 , hardware 1.0). A remote attacker in physical proximity to a Wi-Fi network can derive the default Wi-Fi PSK value by analyzing the last 4 octets of the BSSID . To minimize the risk of explo...

CVE-2024-53941: Incorrect Authorization

An issue was discovered in Victure RX1800 WiFi 6 Router software ENV1.0.0r12110933, hardware 1.0 devices. A remote attacker in proximity to a Wi-Fi network can derive the default Wi-Fi PSK value via the last 4 octets of the BSSID...

CVE-2024-53939

An issue was discovered in Victure RX1800 WiFi 6 Router software ENV1.0.0r12110933, hardware 1.0 devices. The /cgi-bin/luci/admin/opsw/Dualfrequnapple endpoint is vulnerable to command injection through the 2.4 GHz and 5 GHz name parameters, allowing an attacker to execute arbitrary commands on t...

CVE-2024-53937

An issue was discovered on Victure RX1800 WiFi 6 Router software ENV1.0.0r12110933, hardware 1.0 devices. The TELNET service is enabled by default with admin/admin as default credentials and is exposed over the LAN. The allows attackers to execute arbitrary commands with root-level permissions...

CVE-2024-53940: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in Victure RX1800 WiFi 6 Router software ENV1.0.0r12110933, hardware 1.0 devices. Certain /cgi-bin/luci/admin endpoints are vulnerable to command injection. Attackers can exploit this by sending crafted payloads through parameters intended for the ping utility, enabling...

AZL-53801 CVE-2024-36623 affecting package moby-cli for versions less than 24.0.9-6

moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes...

CVE-2024-4741 affecting package hvloader for versions less than 1.0.1-6

CVE-2024-4741 affecting package hvloader for versions less than 1.0.1-6. An upgraded version of the package is available that resolves this issue...

CVE-2023-6237 affecting package hvloader for versions less than 1.0.1-6

CVE-2023-6237 affecting package hvloader for versions less than 1.0.1-6. An upgraded version of the package is available that resolves this issue...

CVE-2024-23775 affecting package hvloader for versions less than 1.0.1-6

CVE-2024-23775 affecting package hvloader for versions less than 1.0.1-6. An upgraded version of the package is available that resolves this issue...

CVE-2024-23170 affecting package hvloader for versions less than 1.0.1-6

CVE-2024-23170 affecting package hvloader for versions less than 1.0.1-6. An upgraded version of the package is available that resolves this issue...

CVE-2024-10308

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Countdown widget in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

SUSE-SU-2024:4053-1 Security update for ucode-intel

This update for ucode-intel fixes the following issues: - Intel CPU Microcode was updated to the 20241112 release bsc1233313 - CVE-2024-21853: Faulty finite state machines FSMs in the hardware logic in some 4th and 5th Generation Intel Xeon Processors may allow an authorized user to potentially...