CVE-2023-27806

H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the ipqoslanipdellist interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted payload...

CVE-2023-27801

H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted payload...

CVE-2023-27807: Out-of-bounds Write

H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted payload...

H3C Magic R100 Buffer Error Vulnerability

The H3C Magic R100 is a router from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic R100 R100V100R005.bin version, which originates from a discovery containing a stack overflow via the ipqoslanipeditlist interface of /goform/aspForm. An attacker could exploit the...

H3C Magic R100 Buffer Error Vulnerability

The H3C Magic R100 is a router from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic R100 R100V100R005.bin version, which originates from a discovery containing a stack overflow via the EditvsList parameter of /goform/aspForm. An attacker could exploit the vulnerability to...

H3C Magic R100 Buffer Error Vulnerability

The H3C Magic R100 is a router from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic R100 R100V100R005.bin version, which originates from a discovery containing a stack overflow via the DelvsList interface of /goform/aspForm. An attacker could exploit the vulnerability to...

H3C Magic R100 Buffer Error Vulnerability

The H3C Magic R100 is a router from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic R100 R100V100R005.bin version, which originates from a discovery containing a stack overflow via the EditSTList interface of /goform/aspForm. An attacker could exploit the vulnerability to...

H3C Magic R100 Buffer Error Vulnerability

The H3C Magic R100 is a router from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic R100 R100V100R005.bin version, which originates from a discovery containing a stack overflow via the EdittriggerList interface of /goform/aspForm. An attacker exploits the vulnerability to...

H3C Magic R100 Buffer Error Vulnerability

The H3C Magic R100 is a router from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic R100 R100V100R005.bin version, which originates from a discovery containing a stack overflow via the DeltriggerList interface of /goform/aspForm. An attacker exploits the vulnerability to...

WordPress plugin Magic Post Thumbnail: Cross-site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

H3C Magic R100 Buffer Error Vulnerability

The H3C Magic R100 is a router from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic R100 R100V100R005.bin version that originates from a stack overflow contained in the DelDNSHnList interface via /goform/aspForm. An attacker exploits the vulnerability to cause a denial of...

H3C Magic R100 Buffer Error Vulnerability

The H3C Magic R100 is a router from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic R100 R100V100R005.bin version, which originates from a discovery containing a stack overflow via the Delstlist interface of /goform/aspForm. An attacker could exploit the vulnerability to...

CVE-2023-27801

CVE-2023-27801 affects H3C Magic R100 family (R100V100R005.bin). The vulnerability is a stack overflow in the DelDNSHnList interface exposed via /goform/aspForm, leading to Denial of Service. The provided sources consistently describe the same root cause and impact (availability loss) without det...

CVE-2023-27805

CVE-2023-27805 concerns the H3C Magic R100 router (firmware for R100V100R005.bin). The vulnerability is a stack overflow in the EditSTList interface at /goform/aspForm, allowing a crafted payload to trigger a Denial of Service. The publicly documented impact is availability loss (DoS); no explici...

webpack: avoid cross-realm objects

A flaw was found in the webpack package, which could allow a remote attacker to bypass security restrictions caused by the mishandling of the magic comment feature by the ImportParserPlugin.js. This flaw allows an attacker to gain access to the real global object by sending a specially-crafted...

Magic Post Thumbnail < 4.1.11 - Reflected XSS

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Bad Magic APT employs new CommonMagic Framework and PowerMagic Backdoor

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary New Bad magic APT was discovered using a new backdoor called PowerMagic and a malicious framework called CommonMagic to target organizations in the administrative, agriculture, and transportation sectors...

New 'Bad Magic' Cyber Threat Disrupts Ukraine's Key Sectors Amid War

Amid the ongoing war between Russia and Ukraine, government, agriculture, and transportation organizations located in Donetsk, Lugansk, and Crimea have been attacked as part of an active campaign that drops a previously unseen, modular framework dubbed CommonMagic. "Although the initial vector of...

SUSE CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

CVE-2023-28154

A flaw was found in the webpack package, which could allow a remote attacker to bypass security restrictions caused by the mishandling of the magic comment feature by the ImportParserPlugin.js. This flaw allows an attacker to gain access to the real global object by sending a specially-crafted...