PT-2024-2877 · Tenda · Tenda Ac500

Name of the Vulnerable Software and Affected Versions: Tenda AC500 version 2.0.1.91307 Description: A critical issue affects the formQuickIndex function of the /goform/QuickIndex file, leading to a stack-based buffer overflow when the PPPOEPassword argument is manipulated. This can be exploited...

CVE-2023-48724

CVE-2023-48724 affects the TP-Link AC1350 Wireless MU-MIMO G igabit Access Point (EAP225 V3), affected firmware v5.1.0 Build 20220926. Talos reports a memory corruption bug in the web interface (httpd_portal) caused by parsing x-www-form-urlencoded POST parameters in the web UI, leading to a deni...

CVE-2023-48724

A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926. A specially crafted HTTP POST request can lead to denial of service of the device's web interface. An attacker can send an...

CVE-2024-28270

An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword...

CVE-2024-28270

An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword...

web-flash 安全漏洞

web-flash is an enilu open source web system based on Spring Boot and Vue.js. A security vulnerability exists in web-flash version v3.0, which originated from a vulnerability that allows an attacker to reset an arbitrary user's password via a crafted POST request...

CVE-2024-28270

CVE-2024-28270 affects web-flash v3.0. A vulnerability allows an attacker to reset passwords for arbitrary users by sending a crafted POST request to /prod-api/user/resetPassword. CVSS v3.1 base score 8.1 (HIGH); attack vector NETWORK, complexity LOW, privileges LOW, user interaction NONE, with c...

PsiTransfer: Violation of the integrity of file distribution

Summary The absence of restrictions on the endpoint, which allows you to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution. Details Vulnerable endpoint: POST /files PoC 1. Create a file distribution. 2. Go to the link address ...

GHSA-XG8V-M2MH-45M6 PsiTransfer: Violation of the integrity of file distribution

Summary The absence of restrictions on the endpoint, which allows you to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution. Details Vulnerable endpoint: POST /files PoC 1. Create a file distribution. 2. Go to the link address ...

Gibbon School Platform 26.0.00 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Gibbon School Platform Authenticated PHP Deserialization Vulnerability', 'Description' = %q A Remote Code Execution vulnerability in Gibbon onlin...

CVE-2024-29025

A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until ...

WordPress Alemha Watermarker 1.3.1 Cross Site Scripting

Exploit Title: Wordpress Plugin Alemha Watermarker 1.3.1 - Stored Cross-Site Scripting XSS Date: 22 March 2024 Exploit Author: Erdemstar Vendor: https://wordpress.com/ Version: 1.3.1 Proof Of Concept: 1. Click Add New Watermark and enter the XSS payload into the Watermark Text. 2. Stored XSS will...

The vulnerability of the GetParentControlInfo function (/goform/GetParentControlInfo) in the Tenda AC7 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of GetParentControlInfo /goform/GetParentControlInfo in the Tenda AC7 router software is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information through ...

The vulnerability of the fromSetWirelessRepeat function (/goform/WifiExtraSet) in the Tenda AC7 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromSetWirelessRepeat function /goform/WifiExtraSet in the Tenda AC7 router microprogramming system is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

The vulnerability of the setSchedWifi function (/goform/openSchedWifi) in the Tenda AC7 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the setSchedWifi function /goform/openSchedWifi in the Tenda AC7 router microprogramming software is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

Axigen < 10.5.7 - Persistent Cross-Site Scripting

Exploit Title: Axigen alert1 PoC of the POST request: POST /?h=1bb40e85937506a7186a125bd8c5d7ef&page=glset HTTP/1.1 Host: localhost:9443 Cookie: eula=true;...

The vulnerability of the fromSetWifiGuestSetBasic function (/goform/WifiGuestSet) in the Tenda AC7 router software allows a intruder to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromSetWifiGuestSetBasic function /goform/WifiGuestSet in the Tenda AC7 router microprogramming software is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of...

The vulnerability of the formWifiWpsStart function (/goform/WifiWpsStart) in the Tenda AC7 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formWifiWpsStart function /goform/WifiWpsStart in the Tenda AC7 router software is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information through...

The vulnerability of the fromSetRouteStatic function (/goform/SetStaticRouteCfg) in the Tenda AC7 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromSetRouteStatic function /goform/SetStaticRouteCfg in the Tenda AC7 router software is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability of the fromAddressNat function (/goform/addressNat) in the Tenda F1202 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromAddressNat function /goform/addressNat in the Tenda FH1202 router microprogramming system involves reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility ...