Nginx UI 路径遍历漏洞

Nginx UI is a WebUI for Nginx by Jacky Personal Developer. A path traversal vulnerability exists in Nginx UI 2.0.0-beta.35 and earlier versions, which originates from obtaining a value from a json field without authentication, writing an arbitrary file to the server, and leading to loss of...

Putong Online Judge 访问控制错误漏洞

Putong Online Judge is an open source online judging software from acm309. An access control error vulnerability exists in versions prior to Putong Online Judge 2.1.0-beta.1. The vulnerability arises from the ability of an unprivileged user to elevate privileges via a build request, enabling the...

PT-2024-33270 · Putongoj · Putongoj

Name of the Vulnerable Software and Affected Versions: PutongOJ versions prior to 2.1.0-beta.1 Description: PutongOJ is online judging software. Unprivileged users can escalate privileges by constructing requests, leading to unauthorized access and enabling users to perform admin-level operations...

WordPress plugin BigBlueButton 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-7289 · Nginx · Nginx-Ui

Name of the Vulnerable Software and Affected Versions: Nginx UI versions prior to 2.0.0-beta.36 Description: The issue is related to the Nginx UI's configuration of logrotate, where it does not verify input and directly passes it to exec.Command, causing arbitrary command execution. This allows a...

GHSA-27VH-H6MC-Q6G8 btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality

Impact The btcd Bitcoin client versions 0.10 to 0.24 did not correctly re-implement Bitcoin Core's "FindAndDelete" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block or rejecting a...

PT-2024-7511 · Nginx · Nginx-Ui

Name of the Vulnerable Software and Affected Versions: Nginx UI versions 2.0.0-beta.35 and earlier Description: The issue is related to the Nginx UI's handling of JSON fields without proper verification, allowing an attacker to construct a value in the form of ../../ and write arbitrary files to...

CVE-2024-9561

CVE-2024-9561 affects D-Link DIR-605L firmware 2.13B01 BETA, specifically the vulnerable functions formSetWAN_Wizard51/52. The root cause is improper validation of the curTime parameter, leading to a buffer overflow that can be exploited remotely. Multiple connected sources (NVD, Red Hat, CNVD, C...

CVE-2024-9559

A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been classified as critical. Affected is the function formWlanSetup of the file /goform/formWlanSetup. The manipulation of the argument webpage leads to buffer overflow. It is possible to launch the attack remotely. The exploit has...

CVE-2024-9550

A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been classified as critical. Affected is the function formLogDnsquery of the file /goform/formLogDnsquery. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit...

PT-2024-7246 · D Link · D-Link Dir-605L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-605L version 2.13B01 BETA Description: A critical issue has been found in the function formSetEasy Wizard of the file /goform/formSetEasy Wizard. The manipulation of the argument curTime leads to buffer overflow. This can be...

PT-2024-7242 · D Link · Dir-605L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-605L version 2.13B01 BETA Description: A critical issue affects the function formSetWanNonLogin of the file /goform/formSetWanNonLogin. The manipulation of the argument webpage leads to buffer overflow. This can be exploited...

PT-2024-7235 · D Link · D-Link Dir-605L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-605L version 2.13B01 BETA Description: The issue is related to a buffer overflow vulnerability in the formSetWanL2TP function of the /goform/formSetWanL2TP file. This vulnerability can be exploited by sending a specially crafted PO...

CVE-2024-46544 Apache Tomcat Connectors: mod_jk: local users can view and modify configuration

Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing modjk configuration which may lead to information disclosure and/or denial of service. This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49...

CVE-2024-8410

A vulnerability classified as problematic was found in ABCD ABCD2 up to 2.2.0-beta-1. This vulnerability affects unknown code of the file /abcd/opac/php/otrossitios.php. The manipulation of the argument sitio leads to path traversal. The attack can be initiated remotely. The exploit has been...

CVE-2024-8411

A vulnerability was determined in ABCD ABCD2 up to 2.2.0-beta-1. Impacted is an unknown function of the file /buscarintegrada.php. Executing a manipulation of the argument SubExpresion can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly...

CVE-2024-8409 ABCD ABCD2 show_image.php path traversal

A vulnerability classified as problematic has been found in ABCD ABCD2 up to 2.2.0-beta-1. This affects an unknown part of the file /common/showimage.php. The manipulation of the argument image leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has...

ABCD2 跨站脚本漏洞

ABCD2 is an ABCD open source software suite for library and documentation center automation. A cross-site scripting vulnerability exists in ABCD2 2.2.0-beta-1 and earlier versions, which stems from some unknown handling of the file /buscarintegrada.php, where manipulation of the parameter...

ABCD2 路径遍历漏洞

ABCD2 is an ABCD open source software suite for library and documentation center automation. A path traversal vulnerability exists in ABCD2 2.2.0-beta-1 and earlier versions, which stems from unknown code in the file /abcd/opac/php/otrossitios.php, where operation of the parameter sitio results i...

CVE-2024-43027

DrayTek Vigor 3900 before v1.5.1.5Beta, DrayTek Vigor 2960 before v1.5.1.5Beta and DrayTek Vigor 300B before v1.5.1.5Beta were discovered to contain a command injection vulnerability via the action parameter at cgi-bin/mainfunction.cgi...