Mantis Bug Tracker 信息泄露漏洞

Mantis Bug Tracker MantisBT is a bug tracker from Mantis Bug Tracker open source. An information disclosure vulnerability exists in Mantis Bug Tracker version 2.26.3 and earlier versions. An attacker exploits this vulnerability to retrieve information about another user's personal system...

The vulnerability of the cgi_get_fullscreen_photos() function (/cgi-bin/photocenter_mgr.cgi) in the microprogramming software of D-Link devices such as DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 allows a hacker to execute arbitrary commands.

The vulnerability of the cgigetfullscreenphotos function /cgi-bin/photocentermgr.cgi in the microprogramming software of D-Link devices such as DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345,...

PT-2024-31773 · Unknown · Mantis Bug Tracker

Name of the Vulnerable Software and Affected Versions: Mantis Bug Tracker MantisBT versions prior to 2.26.4 Description: The issue allows an unprivileged, registered user to retrieve information about other users' personal system profiles using a crafted POST request. This can lead to the...

The vulnerability of the cgi_FMT_Std2R5_2nd_DiskMGR() function (/cgi-bin/hd_config.cgi) in the D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 devices allows a hacker to execute arbitrary commands.

The vulnerability of the cgiFMTStd2R52ndDiskMGR function /cgi-bin/hdconfig.cgi in the D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04...

CVE-2024-43693

A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands...

CVE-2023-26689

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request...

CVE-2023-26689

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request...

IceCMS 安全漏洞

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation by NgShow individual developers. A security vulnerability exists in IceCMS v3.4.7 and earlier versions, which stems from an access control issue that allows an attacker to arbitrarily modify user...

CVE-2023-26689

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request...

CVE-2023-26689

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request...

CVE-2024-45826

CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file...

CVE-2024-45826 ThinManager® Code Execution Vulnerability

CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file...

CVE-2024-45826 ThinManager® Code Execution Vulnerability

CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file...

CVE-2024-45826

Rockwell Automation ThinManager has a path traversal leading to remote code execution when processing a crafted POST request. Affected versions: ThinManager 13.1.0–13.1.2 and 13.2.0–13.2.1; upgrade to 13.1.3+ or 13.2.2+ to mitigate. CVSSv3 base score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); CVS...

CVE-2023-36103

Command Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run arbitrary commands via crafted POST request...

The vulnerability of D-Link DIR-846W router’s microprogramming software lies in the lack of measures taken to neutralize special elements used in the operating system commands. This allows a hacker to execute arbitrary code.

The vulnerability of the D-Link DIR-846W router’s microprogramming software is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially craft...

The vulnerability of the D-Link DIR-846W router’s microprogramming software lies in the lack of measures taken to neutralize special elements used in the operating system commands. This allows a hacker to execute arbitrary code.

The vulnerability of the D-Link DIR-846W router’s microprogramming software is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially craft...

The vulnerability of the fromAddressNat function in the Tenda FH1201 router microprogramming system allows a hacker to induce a service failure.

The vulnerability of the fromAddressNat function in the Tenda FH1201 router microprogramming system is related to the possibility of buffer overflow based on a stack. Exploiting this vulnerability can allow an attacker, operating remotely, to trigger a Denial-of-Service attack by sending a...

CVE-2024-44342

D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution RCE vulnerability via the wl0.0ssid parameter. This vulnerability is exploited via a crafted POST request...

CVE-2024-44341

D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution RCE vulnerability via the lan0dhcpsstaticlist parameter. This vulnerability is exploited via a crafted POST request...