4580 matches found
Directory traversal
Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive information via a crafted GET request...
CVE-2023-41101
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. getquery in httpmicrohttpd.c does not validate the length of the query string of GET requests. This leads to a stack-based buffer overflow in versions 9.x and earlier, and to a heap-based buffer overflow in versions...
CVE-2023-38322
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a dobinauth NULL pointer dereference that be triggered with a crafted GET HTTP request with a missing User-Agent HTTP header. Triggering this issue results in crashing OpenNDS a Denial-of-Service condition. The issue...
CVE-2023-38316
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt...
CVE-2023-38315
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a trytoauthenticate NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing client token query string parameter. Triggering this issue results in crashing OpenNDS a Denial-of-Service...
DEBIAN-CVE-2023-38313
An issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a dobinauth NULL pointer dereference that can be triggered with a crafted GET HTTP request with a missing client redirect query string parameter. Triggering this issue results in crashing openNDS a Denial-of-Service condition...
DEBIAN-CVE-2023-38314
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a NULL pointer dereference in preauthenticated that can be triggered with a crafted GET HTTP request with a missing redirect query string parameter. Triggering this issue results in crashing OpenNDS a Denial-of-Servic...
Heap overflow
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. getquery in httpmicrohttpd.c does not validate the length of the query string of GET requests. This leads to a stack-based buffer overflow in versions 9.x and earlier, and to a heap-based buffer overflow in versions...
OpenNDS Buffer Error Vulnerability
openNDS is openNDS open source a high-performance , small footprint portal system . A buffer error vulnerability exists in versions of OpenNDS prior to 10.1.3, which stems from not validating the length of a query string for a GET request, and can lead to a stack-based buffer overflow that can be...
openNDS Security Vulnerabilities
openNDS is openNDS open source a high-performance, small footprint portal system. A security vulnerability exists in versions of openNDS prior to 10.1.2 that originates from an attacker being able to execute an arbitrary operating system command by inserting it into the URL portion of an HTTP GET...
CVE-2023-48185
CVE-2023-48185 affects TerraMaster NAS firmware versions v.s1.0 through v.2.295. It is a Directory Traversal vulnerability that allows a remote attacker to obtain sensitive information via a crafted GET request. The NVD entry shows CVSS v3.1 base score 7.5 (Network, Low attack complexity, No priv...
CVE-2023-48185
Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive information via a crafted GET request...
CVE-2023-38316: Improper Encoding or Escaping of Output
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt...
CVE-2023-48185: Improper Limitation of a Pathname to a Restricted Directory
Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive information via a crafted GET request...
PT-2023-30180 · Librenms · Librenms
Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 23.11.0 Description: The issue concerns the login method in LibreNMS, which lacks a rate limit, allowing an attacker to potentially gain access to user accounts through brute force attacks. The login method uses a G...
WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery
Description This plugin is vulnerable to server-side request forgery SSRF via the path parameter. PoC Send a GET request to wpb-show-core/download-file.php with the path parameter set to an arbitrary URL http://example.com/latest/meta-data/iam/security-credentials/wpb-apps-prod-role the website...
Remote file inclusion
A local file inclusion vulnerability has been found in WPN-XM Serverstack affecting version 0.8.6, which would allow an unauthenticated user to perform a local file inclusion LFI via the /tools/webinterface/index.php?page parameter by sending a GET request. This vulnerability could lead to the...
CVE-2023-46236
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery SSRF vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote...