HTTP Request/Response Smuggling

Twisted is vulnerable to HTTP Request/Response Smuggling. The vulnerability is due to the HTTP 1.0 and 1.1 server provided by twisted.web which can process pipelined HTTP requests out-of-order...

Zomato: OTP Bypass via Response Manipulation

OTP One-Time Password bypass via response manipulation is a technique where an attacker intercepts and alters the server's response to bypass the OTP verification step. Response Manipulation: The attacker manipulates the server's response. For example, they might change a response indicating OTP...

CVE-2024-7217

TOTOLINK CA300-PoE 6.2c.884 is affected by CVE-2024-7217. The vulnerability resides in the loginauth function of /cgi-bin/cstecgi.cgi, where manipulation of the password argument causes a buffer overflow. Exploitation can be performed remotely, and public disclosures exist. Affected software/vers...

PT-2024-38422 · Logsign · Logsign Unified Secops Platform

Name of the Vulnerable Software and Affected Versions: Logsign Unified SecOps Platform affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of Logsign Unified SecOps Platform. Authentication is required to...

Matrix Tafnit 安全漏洞

Matrix Tafnit is an enterprise resource planning solution from Matrix. A security vulnerability exists in Matrix Tafnit version v8 that stems from observable response differences...

PT-2024-28000 · Unknown · Matrix Tafnit

Name of the Vulnerable Software and Affected Versions: Matrix Tafnit version 8 Description: The issue is related to Observable Response Discrepancy, identified as CWE-204. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where...

CVE-2024-41671 twisted.web has disordered HTTP pipeline response

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1...

CVE-2024-7188 Bylancer Quicklancer GET Parameter listing sql injection

A vulnerability was found in Bylancer Quicklancer 2.4. It has been rated as critical. This issue affects some unknown processing of the file /listing of the component GET Parameter Handler. The manipulation of the argument range2 leads to sql injection. The attack may be initiated remotely. The...

CVE-2024-7184 TOTOLINK A3600R cstecgi.cgi setUrlFilterRules buffer overflow

A vulnerability has been found in TOTOLINK A3600R 4.1.2cu.5182B20201102 and classified as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument url leads to buffer overflow. The attack can be launched remotely...

CVE-2024-7181 TOTOLINK A3600R cstecgi.cgi setTelnetCfg command injection

A vulnerability classified as critical was found in TOTOLINK A3600R 4.1.2cu.5182B20201102. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument telnetenabled leads to command injection. The attack can be initiated remotely. The...

CVE-2024-7180

A vulnerability classified as critical has been found in TOTOLINK A3600R 4.1.2cu.5182B20201102. This affects the function setPortForwardRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument comment leads to buffer overflow. It is possible to initiate the attack remotely. The...

CVE-2024-7178

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182B20201102. It has been declared as critical. Affected by this vulnerability is the function setMacQos of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument priority/macAddress leads to buffer overflow. The attack can be launche...

CVE-2024-7180

TOTOLINK A3600R is affected by a buffer overflow in the setPortForwardRules function (in /cgi-bin/cstecgi.cgi) caused by improper validation of the comment parameter. Affected version: 4.1.2cu.5182_B20201102. The issue can be exploited remotely, and public exploits have been disclosed. Multiple s...

CVE-2024-7180 TOTOLINK A3600R cstecgi.cgi setPortForwardRules buffer overflow

A vulnerability classified as critical has been found in TOTOLINK A3600R 4.1.2cu.5182B20201102. This affects the function setPortForwardRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument comment leads to buffer overflow. It is possible to initiate the attack remotely. The...

CVE-2024-7174 TOTOLINK A3600R cstecgi.cgi setdeviceName buffer overflow

A vulnerability, which was classified as critical, was found in TOTOLINK A3600R 4.1.2cu.5182B20201102. This affects the function setdeviceName of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument deviceMac/deviceName leads to buffer overflow. It is possible to initiate the attack...

CVE-2024-7160

The CVE-2024-7160 entry concerns TOTOLINK A3700R (version 9.1.2u.5822_B20200513). Affects the function setWanCfg in /cgi-bin/cstecgi.cgi; manipulating the hostName parameter leads to command injection. Exploitation is described as remote with public disclosure. Multiple connected references corro...

CVE-2024-7159 TOTOLINK A3600R Telnet Service product.ini hard-coded password

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182B20201102. It has been rated as critical. This issue affects some unknown processing of the file /webcste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. The exploit has been...

CVE-2024-7155

TOTOLINK A3300R, version 17.0.0cu.557_B20221024, has a vulnerability in the /etc/shadow.sample file where a hard-coded password is used via an unknown functionality. This enables a local attack with high attack complexity and public disclosure of the exploit. No fixed version is listed in the pro...

GHSA-296Q-RJ83-G9RQ Reflected Cross Site-Scripting (XSS) in Oveleon Cookiebar

usd-2024-0009 | Reflected XSS in Oveleon Cookiebar Details Advisory ID: usd-2024-0009 Product: Cookiebar Affected Version: 2.X Vulnerability Type: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Security Risk: HIGH,...

CVE-2024-7117

The CVE-2024-7117 entry describes a SQL injection in MD-MAFUJUL-HASAN Online-Payroll-Management-System affecting an unknown function in /shift_viewmore.php, triggered by manipulating the id parameter. It is exploitable remotely and exploits have been disclosed publicly. Product uses rolling relea...