CVE-2024-28270

An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword...

web-flash 安全漏洞

web-flash is an enilu open source web system based on Spring Boot and Vue.js. A security vulnerability exists in web-flash version v3.0, which originated from a vulnerability that allows an attacker to reset an arbitrary user's password via a crafted POST request...

CVE-2024-28270

CVE-2024-28270 affects web-flash v3.0. A vulnerability allows an attacker to reset passwords for arbitrary users by sending a crafted POST request to /prod-api/user/resetPassword. CVSS v3.1 base score 8.1 (HIGH); attack vector NETWORK, complexity LOW, privileges LOW, user interaction NONE, with c...

The vulnerability of the fromSetWirelessRepeat function (/goform/WifiExtraSet) in the Tenda AC7 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromSetWirelessRepeat function /goform/WifiExtraSet in the Tenda AC7 router microprogramming system is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

The vulnerability of the formWifiWpsStart function (/goform/WifiWpsStart) in the Tenda AC7 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formWifiWpsStart function /goform/WifiWpsStart in the Tenda AC7 router software is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information through...

The vulnerability of the fromSetRouteStatic function (/goform/SetStaticRouteCfg) in the Tenda AC7 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromSetRouteStatic function /goform/SetStaticRouteCfg in the Tenda AC7 router software is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability of the fromAddressNat function (/goform/addressNat) in the Tenda FH1202 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromAddressNat function /goform/addressNat in the Tenda FH1202 router microprogramming system involves reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility ...

CVE-2023-50969

Thales Imperva SecureSphere WAF 14.7.0.40 allows remote attackers to bypass WAF rules via a crafted POST request, a different vulnerability than CVE-2021-45468...

CVE-2024-25239

SQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL commands via crafted POST request to /emloyeeakpoly/Account/login.php...

CVE-2024-23721

A Directory Traversal issue was discovered in processpost on Draytek Vigor3910 4.3.2.5 devices. When sending a certain POST request, it calls the function and exports information...

CVE-2024-26492

An issue in Online Diagnostic Lab Management System 1.0 allows a remote attacker to gain control of a 'Staff' user account via a crafted POST request using the id, email, password, and cpass parameters...

Design/Logic Flaw

An issue in Online Diagnostic Lab Management System 1.0 allows a remote attacker to gain control of a 'Staff' user account via a crafted POST request using the id, email, password, and cpass parameters...

PT-2024-21406 · Unknown · Online Diagnostic Lab Management System

Name of the Vulnerable Software and Affected Versions: Online Diagnostic Lab Management System version 1.0 Description: The issue allows a remote attacker to gain control of a 'Staff' user account via a crafted POST request. The attacker can exploit this by using the id, email, password, and cpas...

CVE-2024-26492

An issue in Online Diagnostic Lab Management System 1.0 allows a remote attacker to gain control of a 'Staff' user account via a crafted POST request using the id, email, password, and cpass parameters...

CVE-2024-26492

An issue in Online Diagnostic Lab Management System 1.0 allows a remote attacker to gain control of a 'Staff' user account via a crafted POST request using the id, email, password, and cpass parameters...

CVE-2024-27571

LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the makeCurRemoteApList function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-27567

LBT T300- T390 v2.2.1.8 were discovered to contain a stack overflow via the vpnclientip parameter in the configvpnpptp function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-27571

LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the makeCurRemoteApList function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-27569

LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the initnvram function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-27568

LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the apnname3g parameter in the setupEC20Apn function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...