CVE-2024-25735

An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request...

Tenda FH1202 安全漏洞

The Tenda FH1202 is a wireless router from Tenda China. A buffer overflow vulnerability exists in the Tenda FH1202 version 1.2.0.14408, which is caused by the mac parameter of the GetParentControlInfo method in the /goform/GetParentControlInfo file failing to correctly validate the length of the...

Tenda FH1205 安全漏洞

The Tenda FH1205 is a wireless router from Tenda China. A security vulnerability exists in the Tenda FH1205 version 2.0.0.7775, which is caused by a stack-based buffer overflow in the mac parameter of the GetParentControlInfo method of the /goform/GetParentControlInfo file...

Ivanti Cloud Services Appliance exec cookie command injection

Added: 03/26/2024 Background Ivanti Cloud Services Appliance CSA is an appliance that connects the console and managed devices over the Internet. Problem Cloud Services Appliance 4.5 and 4.6 are affected by a vulnerability which could allow a remote unauthenticated attacker to inject arbitrary...

PT-2024-13306 · Libglvnd +2 · Libglvnd +2

Name of the Vulnerable Software and Affected Versions: OpenGL libglvnd version bb06db5a Description: A segmentation violation was discovered in the libglxproto.c file of OpenGL libglvnd via the glXGetDrawableScreen function. This issue is disputed as there are no common situations where users...

Untrusted Search Path

Overview Affected versions of this package are vulnerable to Untrusted Search Path due to the use of an unprotected C:\Windows\Temp directory to copy and execute binaries. When a bundle runs as the SYSTEM user, it uses GetTempPathW which points to this insecure directory to drop and load multiple...

DEBIAN-CVE-2021-47159

In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix a crash if -getssetcount fails If ds-ops-getssetcount fails then it "count" is a negative error code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative error code is type promoted to a very high value...

DEBIAN-CVE-2021-47149

In the Linux kernel, the following vulnerability has been resolved: net: fujitsu: fix potential null-ptr-deref In fmvj18xgethwinfo, if ioremap fails there will be NULL pointer deref. To fix this, check the return value of ioremap and return -1 to the caller in case of failure...

PT-2024-11207 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability has been resolved in the Linux kernel. The issue occurs when ds-ops-get sset count fails, resulting in a negative error code, such as -EOPNOTSUPP. Because i is an...

Home-Made.io Fastmag Sync 安全漏洞

Home-Made.io Fastmag Sync is a business management synchronization program from Home-Made.io. A security vulnerability exists in Home-Made.io Fastmag Sync v.1.7.51 and earlier versions, which originates from a vulnerability that allows remote attackers to execute arbitrary code via the getPhpBin...

PT-2024-22405

Name of the Vulnerable Software and Affected Versions Home-Made.io fastmagsync versions 1.7.51 and before Description An issue in Home-Made.io fastmagsync allows a remote attacker to execute arbitrary code via the getPhpBin component. Recommendations For versions 1.7.51 and before, consider...

SSRF Vulnerability on assetlinks_check(act_name, well_knowns)

Summary While examining the "App Link assetlinks.json file could not be found" vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET request was sent to the "/.well-known/assetlinks.json" endpoint for all hosts written with "android:host". In the...

GHSA-WFGJ-WRGH-H3R3 SSRF Vulnerability on assetlinks_check(act_name, well_knowns)

Summary While examining the "App Link assetlinks.json file could not be found" vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET request was sent to the "/.well-known/assetlinks.json" endpoint for all hosts written with "android:host". In the...

CVE-2023-4063

Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request...

CVE-2023-4063

HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service caused by an improper eSCL URL GET request. The CVE-2023-4063 entry indicates a network-exposed issue with availability impact, CVSS v3.1 base score 5.3 (Low for availability). Affected component is the printer’s eSCL han...

Win32.STOP.Ransomware (Smokeloader) MVID-2024-0676 Remote Code Execution

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2024 Original source: https://malvuln.com/advisory/3b9e9e130d52fe95c8be82aa4b8feb74.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Win32.STOP.Ransomware smokeloader Vulnerability: Remote Code Execution MITM Family: Stop...

PT-2024-18637 · WordPress · Buddypress Woocommerce My Account Integration

Name of the Vulnerable Software and Affected Versions: BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress versions up to, and including, 3.4.20 Description: The issue concerns PHP Object Injection via deserialization of untrusted input in the get...

CVE-2024-24110

SQL Injection vulnerability in crmebjava before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the component /api/front/spread/people...

CVE-2024-2669 Campcodes Online Job Finder System GET Parameter controller.php sql injection

A vulnerability was found in Campcodes Online Job Finder System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/employee/controller.php of the component GET Parameter Handler. The manipulation of the argument EMPLOYEEID leads to sql injection. The...

kernel: nfp: use-after-free in area_cache_get()

A vulnerability was found in areacacheget in drivers/net/ethernet/netronome/nfp/nfpcore/nfpcppcore.c in the Netronome Flow Processor NFP driver in the Linux kernel. This flaw allows a manipulation that may lead to a use-after-free issue...