The vulnerability of the Radio Scheduling component in the microprogramming software of Tp-Link AC1350 allows a intruder to execute arbitrary code.

The vulnerability of the Radio Scheduling component in the microprogramming software of Tp-Link AC1350 wireless access points is related to buffer overflows in the stack when processing the band parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using...

CVE-2024-1666

In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side checks to verify if a user is on a free account during the radar creation process, which is only enforced in the web UI. As a result,...

CVE-2024-1666

In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side checks to verify if a user is on a free account during the radar creation process, which is only enforced in the web UI. As a result,...

CVE-2024-1666 Unauthorized Radar Creation in lunary-ai/lunary

In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side checks to verify if a user is on a free account during the radar creation process, which is only enforced in the web UI. As a result,...

CVE-2024-1666 Unauthorized Radar Creation in lunary-ai/lunary

In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side checks to verify if a user is on a free account during the radar creation process, which is only enforced in the web UI. As a result,...

CVE-2024-1666

CVE-2024-1666 affects lunary-ai/lunary 1.0.0, where an authorization flaw allows unauthorized radar creation. The root cause is missing server-side checks to verify a user’s paid/upgraded status during radar creation (enforced only in the web UI). Attackers can bypass account upgrade requirements...

Lunary 安全漏洞

Lunary is a production toolkit for LLM that is open sourced by lunary. A security vulnerability exists in Lunary version 1.0.0 that stems from an authorization flaw in the application. An attacker exploiting the vulnerability could send a carefully crafted request directly to the server to bypass...

SAP NetWeaver SSRF (April 2024)

SAP NetWeaver is affected by a server-side request forgery SSRF vulnerability. Due to insufficient input validation, SAP NetWeaver application tcesiespgrmgwshealthcheckear allows an unauthenticated attacker to send crafted requests from a vulnerable web application targeting internal systems behi...

CVE-2024-1481

A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to a denial of service...

CVE-2024-21756

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests...

CVE-2024-21755

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests...

CVE-2024-21755

Fortinet FortiSandbox is affected by an os command injection vulnerability (CVE-2024-21755) in multiple releases: 4.0.0–4.0.4, 4.2.0–4.2.6, and 4.4.0–4.4.3. The issue stems from improper neutralization of special elements used in an os command, allowing an attacker to execute unauthorized code or...

CVE-2024-21756

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests...

CVE-2024-27898

CVE-2024-27898 concerns SAP NetWeaver SSRF due to insufficient input validation. The vulnerability allows an unauthenticated or internal-web-app–initiated request to reach internal systems behind firewalls, enabling server-side request forgery with a low confidentiality impact. Documented metrics...

TP-LINK AC1350 缓冲区错误漏洞

The TP-LINK AC1350 is a router from China P&L TP-LINK. The TP-LINK AC1350 contains a security vulnerability that can be exploited by an attacker to cause remote code execution via a series of specially crafted HTTP requests...

TP-LINK AC1350 安全漏洞

The TP-LINK AC1350 is a router from China P&L TP-LINK. The TP-LINK AC1350 suffers from a security vulnerability that can be exploited by an attacker to cause a reset to factory settings via a series of specially crafted network requests...

TP-LINK AC1350 缓冲区错误漏洞

The TP-LINK AC1350 is a router from China P&L TP-LINK. The TP-LINK AC1350 suffers from a security vulnerability that can be exploited by an attacker to cause remote code execution via a series of specially crafted HTTP requests...

CVE-2024-22052

Technical details about CVE-2024-22052 are not publicly provided in the supplied documents. Monitor for updates from authoritative sources.

undertow: unrestricted request storage leads to memory exhaustion

A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory...

CVE-2023-1973

A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory...