CVE-2024-30973

An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitive information via crafted POST request to /boaform/getASPdata/formFirewall, /boaform/getASPdata/formAcc...

The vulnerability of the formWifiMacFilterGet function in Tenda i21 router microprogramming software allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formWifiMacFilterGet function in Tenda i21 router microprogramming software is related to buffer overflow in the stack when processing the index parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of...

Zebra ZTC Industrial ZT400 and ZTC Desktop GK420d Authentication Bypass Using an Alternate Path or Channel (CVE-2023-4957)

A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in the same network as the printer, to change the username and password for the Web Page by sending a specially crafted POST request to the...

The vulnerability of the sub_42C014() function (/goform/PowerSaveSet) in the Tenda TX9 Pro router’s microprogramming system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sub42C014 function /goform/PowerSaveSet of the Tenda TX9 Pro router’s microprogramming software is related to the execution of operations outside the buffer in memory when processing the time parameter. Exploiting this vulnerability can allow an attacker to compromise the...

The vulnerability of the formSetUplinkInfo function (/goform/setUplinkInfo) in the Tenda i21 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetUplinkInfo /goform/setUplinkInfo function in the Tenda i21 router microprogramming software is related to buffer overflow during the processing of the pingHostIp2 parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality,...

CVE-2024-34502

An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will attempt to make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit...

CVE-2024-34502

CVE-2024-34502 affects WikibaseLexeme in MediaWiki up to specific versions: before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. The flaw allows Special:MergeLexemes to trigger an edit merging the from-id into the to-id even when the request is not POST and lacks an edit token, effectiv...

aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests

Summary An attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. Impact An attacker can stop the application from serving requests after sending a single...

CVE-2024-27453

Summary: CVE-2024-27453 affects Extreme XOS up to version 22.6.1.4. A read-only user can escalate to root by sending a crafted HTTP POST to the Machine-to-Machine Interface (MMI) Python method. This is a network-accessible vulnerability with no user interaction required. Affected software/area: E...

SOPlanning 1.52.00 SQL Injection

Exploit Title: SOPlanning v1.52.00 'projets.php' SQLi Application: SOPlanning Version: 1.52.00 Date: 4/22/24 Exploit Author: Joseph McPeters Liquidsky Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/ Tested on: Linux CVE: Not yet assigned...

PT-2024-21906 · Extreme · Extremexos

Name of the Vulnerable Software and Affected Versions: Extreme XOS versions 22.6.1.4 and earlier Description: A read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machine Interface MMI. Recommendations: For Extreme XOS versions...

CVE-2024-27453

In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machine Interface MMI...

HackerOne: Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json Endpoint

The Insecure Direct Object Reference IDOR vulnerability allowed viewing private report details through the /bugs.json endpoint. Any private reports could be accessed by sending a POST request to the endpoint with the organization ID and a single-digit text query. This gave access to sensitive...

CVE-2024-30251

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further request...

CVE-2024-30251

CVE-2024-30251 affects aio-libs aiohttp. An attacker can send a specially crafted POST (multipart/form-data) request and the aiohttp server may enter an infinite loop while processing it, causing a denial of service. The issue is addressed in a patched version (3.9.4); remediation is to upgrade t...

CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further request...

CVE-2024-32882

Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more...

Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

Impact If a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific...

CVE-2023-46295

An issue was discovered in Teledyne FLIR M300 2.00-19. Unauthenticated remote code execution can occur in the web server. An attacker can exploit this by sending a POST request to the vulnerable PHP page. An attacker can elevate to root permissions with Sudo...

CVE-2023-46295

CVE-2023-46295 affects Teledyne FLIR M300 firmware up to version 2.00-19. The issue is in the web server: unauthenticated remote code execution can be triggered by sending a POST request to a vulnerable PHP page, with the potential to escalate to root via Sudo. Public sources confirm the vulnerab...