36 matches found
CVE-2024-57479
CVE-2024-57479 affects H3C N12, firmware version V100R005. The issue is a buffer overflow caused by lack of length verification in the MAC address update function, which can allow the remote execution of commands or a device crash via a POST to "/bin/webs". Reports in PT-2025-3452 describe a temp...
PT-2025-3452
Name of the Vulnerable Software and Affected Versions H3C N12 version V100R005 Description The issue is due to a lack of length verification in the mac address update function, leading to a buffer overflow. Attackers who successfully exploit this can cause the remote target device to crash or...
CVE-2024-57479
H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the mac address update function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request to /bin/we...
CVE-2024-8795 BA Book Everything <= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeover
The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This is due to missing or incorrect nonce validation on the myaccountupdate function. This makes it possible for unauthenticated attackers to update a user's accou...
CVE-2024-8795 BA Book Everything <= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeover
The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This is due to missing or incorrect nonce validation on the myaccountupdate function. This makes it possible for unauthenticated attackers to update a user's accou...
UBUNTU-CVE-2024-0748
A compromised content process could have updated the document URI. This could have allowed an attacker to set an arbitrary URI in the address bar or history. This vulnerability affects Firefox 122...
WP Customer Area < 8.2.1 - Subscriber+ Account Address Update
Description The plugin does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address. You may get the nonce from your save address form fetch"https://example.com/wp-admin/admin-ajax.php", "headers": "content-type":...
CVE-2023-30544 Kiwi TCMS may allow user to update email address to unverified one
Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the My profile admin page. This page allowed them to change the email address registered with their account without the ownership verification performed...
Total loss of funds on owner account compromise
Lines of code Vulnerability details Issue: The vault address may be arbitrarily updated by the owner using setVaultAddress. The owner can also call withdrawAll to move all funds to the vault. Consequence: A malicious owner or owner account compromise can siphon the entire contract's funds to an...
CVE-2021-24892 Advanced Forms < 1.6.9 - Subscriber+ Arbitrary User Email Address Update via IDOR
Insecure Direct Object Reference in edit function of Advanced Forms Free & Pro before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this...
SUSE: Security Advisory (SUSE-SU-2015:0439-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Security update for connman (moderate)
openSUSE Security Update: Security update for connman Announcement ID: openSUSE-SU-2021:0452-1 Rating: moderate References: 1181751 Cross-References: CVE-2021-26675 CVE-2021-26676 CVSS scores: CVE-2021-26675 NVD : 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26676 NVD : 6.5...
Qualcom qseecom driver 安全漏洞
Qualcom qseecom driver is a kernel interface from Qualcom. It provides the kernel driver with a bridge between the userland Normal world and the Secure world. A security vulnerability exists in the qseecom driver, which arises from a potentially arbitrary memory corruption when updating a physica...
gitea -- multiple vulnerabilities
The Gitea Team reports for release 1.11.0: Never allow an empty password to validate 9682 9683 Prevent redirect to Host 9678 9679 Swagger hide search field 9554 Add "search" to reserved usernames 9063 Switch to fomantic-ui 9374 Only serve attachments when linked to issue/release and if accessible...
CVE-2011-1104
Multiple cross-site request forgery CSRF vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that 1 change a PIN, 2 delete messages, 3 add a delivery address, or 4 change a delivery address...