CVE-2024-4250

CVE-2024-4250 affects Tenda i21 1.0.0.14(4656). The vulnerability is in the function formwrlSSIDset of the file /goform/wifiSSIDset, where manipulation of the ssidIndex argument leads to a stack-based buffer overflow. This is a network-exposed flaw with potential remote exploitation, and public w...

CVE-2024-4249

The CVE-2024-4249 entry affects Tenda i21 firmware 1.0.0.14(4656). The vulnerable component is the function formwrlSSIDget in the file /goform/wifiSSIDget, where manipulating the argument ssidIndex causes a stack-based buffer overflow. The vulnerability can be exploited remotely, and public explo...

CVE-2024-4248

CVE-2024-4248 affects Tenda i21, version 1.0.0.14(4656). The vulnerability stems from the parameter handling in the function formQosManage_user , where manipulating the argument ssidIndex triggers a stack-based buffer overflow. Reported as remotely exploitable with network access and high impact ...

Apache HTTP Server: HTTP Response Splitting in multiple modules

...

RHEL 7 : rh-ruby25-ruby (RHSA-2018:3731)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3731 advisory. - ruby: HTTP response splitting in WEBrick CVE-2017-17742 - ruby: Unintentional file and directory creation with directory traversal in...

RHEL 6 / 7 : rh-ruby23-ruby (RHSA-2018:3729)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3729 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...

CVE-2024-4242

A vulnerability was found in Tenda W9 1.0.0.74456. It has been rated as critical. This issue affects the function formwrlSSIDget of the file /goform/wifiSSIDget. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has...

CVE-2024-4240

A vulnerability was found in Tenda W9 1.0.0.74456. It has been classified as critical. This affects the function formQosManageDoubleuser. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The associated identifier of...

CVE-2024-32887

Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it t...

CVE-2024-32887 Reflected XSS in sidekiq

Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it t...

CVE-2024-32887

CVE-2024-32887 is a reflected XSS in Sidekiq’s Web UI where the substr parameter is echoed without encoding, enabling injection of JavaScript into responses and potential targeting of users of Sidekiq Web UI and other applications on the same domain. Affected component: Sidekiq Web UI (Ruby). Roo...

CVE-2024-4240

CVE-2024-4240 affects Tenda W9 1.0.0.7(4456). The vulnerability is in the function formQosManageDouble_user where manipulating the argument ssidIndex causes a stack-based buffer overflow . This can be triggered remotely, per multiple sources, indicating a network-delivered risk with potential arb...

SUSE CVE-2024-25583

A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected...

CVE-2024-33600

A flaw was found in the glibc netgroup cache. After a failed cache insertion, addgetnetgrentX tries to send the non-existing response after the not-found header. This can lead to a null pointer dereference that causes a crash or exit. Mitigation Mitigation for this issue is either not available o...

CVE-2024-0874 Coredns: cd bit response is cached and served later

A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching...

Wordfence Intelligence Weekly WordPress Vulnerability Report (April 15, 2024 to April 21, 2024)

Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure! Last week, there were 209 vulnerabilities disclosed in 169 WordPres...

NDR in the Modern Cybersecurity Landscape

By Uzair Amir The role of Network Detection and Response NDR in cybersecurity. Learn how NDR tools empower organizations to tackle evolving threats effectively. This is a post from HackRead.com Read the original post: NDR in the Modern Cybersecurity Landscape...

CVE-2024-4171

The CVE-2024-4171 entry concerns Tenda W30E routers (versions 1.0–1.0.1.25). The vulnerability lies in the function fromWizardHandle in /goform/WizardHandle, where manipulating the PPW argument triggers a stack-based buffer overflow. This flaw can be exploited remotely and has been publicly discl...

CVE-2024-4167

CVE-2024-4167 affects Tenda 4G300 with firmware 1.01.42. The vulnerability targets the function sub_422AA4 and arises from manipulation of year/month/day/hour/minute/second arguments, causing a stack-based buffer overflow that can be exploited remotely. References indicate VDB-261986 as the vulne...

CVE-2024-4166

CVE-2024-4166 affects Tenda 4G300, vulnerable in version 1.01.42. The vulnerability lies in the function sub_41E858, where improper handling of the GO/page argument causes a stack-based buffer overflow. Exploitation is described as remotely possible over a network, with high impact on confidentia...