CVE-2024-39211

Kaiten 57.128.8 (workflow management system) is affected by CVE-2024-39211. A crafted POST request to the login endpoint can cause information leakage because the login response reveals a user_email field only when the target user exists, enabling remote attackers to enumerate user accounts. This...

CVE-2024-39211

Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a useremail field only if the user account exists...

The vulnerability of the setwirelessrepeat function (/goform/WifiExtraSet) in the Tenda A301 router software allows a hacker to cause a service failure.

The vulnerability of the setwirelessrepeat /goform/WifiExtraSet function in the Tenda A301 router software lies in buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure through the wpapskcrypto parameter using a specially crafted POST...

CVE-2024-39243

An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editorsave...

CVE-2024-39243

CVE-2024-39243 affects skycaiji 2.8. An attacker can execute arbitrary code via a crafted POST request to /index.php?s=/admin/develop/editor_save. The connected sources (Red Hat, NVD, CVE listings, CNNVD, OSV, CVE community listings) corroborate the same vector; no vendor-confirmed patch or fixed...

CVE-2024-37734

An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter...

CVE-2024-37734

An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter...

CVE-2024-4748 RCE in Cruddiy

The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which...

CVE-2024-4748 RCE in Cruddiy

The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which...

PT-2024-32629 · Cruddiy · Cruddiy

Name of the Vulnerable Software and Affected Versions: CRUDDIY affected versions not specified Description: The issue allows for shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally...

CVE-2024-37665

An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST request...

CVE-2024-37665

An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST request...

PT-2024-27704 · Unknown · Wvp Gb28181 Pro

Name of the Vulnerable Software and Affected Versions: Wvp GB28181 Pro version 2.0 Description: An access control issue allows authenticated attackers to escalate privileges to Administrator via a crafted POST request. Recommendations: For Wvp GB28181 Pro version 2.0, consider restricting access ...

CVE-2024-37665

CVE-2024-37665 affects WVP GB28181 Pro 2.0. An access-control flaw lets authenticated attackers escalate privileges to Administrator via a crafted POST request. The CVSS v3.1 base score is 8.8 (HIGH) with network access, low attack complexity, and required privileges Low. No exploitation details ...

PT-2024-4206 · Schneider Electric · Schneider Electric Sage

Name of the Vulnerable Software and Affected Versions: Schneider Electric Sage affected versions not specified Description: The issue is related to a buffer overflow in memory, which could allow a remote attacker to bypass authentication by sending a specially crafted POST request and setting...

The vulnerability of the fromRouteStatic function in the Tenda W30E router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromRouteStatic function in the Tenda W30E router software relates to the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected informati...

The vulnerability of the frmL7PlotForm function in the microprogramming software for Tenda W30E allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromDhcpListClient function in the Tenda W30E router software relates to the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected informatio...

CVE-2024-34995

svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under com.cym.controller.UserControllerimportOver. This vulnerability allows attackers to delete arbitrary files via a crafted POST request...

CVE-2024-34995

svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under com.cym.controller.UserControllerimportOver. This vulnerability allows attackers to delete arbitrary files via a crafted POST request...

The vulnerability of the fromDhcpListClient function (implemented in the microprogramming software for Tenda FH1206 routers) allows a attacker to trigger a service failure or execute arbitrary code.

The vulnerability of the fromDhcpListClient function implemented in the Tenda FH1206 router’s software is related to buffer overflows in the stack when processing the page parameter. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code by sending...