882 matches found
OpenPanel 0.3.4 Command Injection Vulnerability
Exploit Title: OpenPanel 0.3.4 - OS Command Injection via The Timezone Parameter Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee Vendor Homepage: https://openpanel.com/ Software Link: https://openpanel.com/ Version: 0.3.4 Tested on: macOS CVE : CVE-2024-53584 POST...
OpenPanel 0.3.4 Command Injection
OpenPanel version 0.3.4 suffers from a remote command injection vulnerability via the timezone parameter. Exploit Title: OpenPanel 0.3.4 - OS Command Injection via The Timezone Parameter Date: Nov 25, 2024 Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee Vendor Homepage:...
SUSE-SU-2025:0235-1 Security update for java-11-openjdk
This update for java-11-openjdk fixes the following issues: Upgrade to upstream tag jdk-11.0.26+4 January 2025 CPU Security fixes: - CVE-2025-21502: Enhance array handling JDK-8330045, bsc1236278 Other changes: - JDK-8224624: Inefficiencies in CodeStrings::addcomment cause - timeouts - JDK-822504...
OSV-2025-52 Use-of-uninitialized-value in icalmemory_strdup
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=390646669 Crash type: Use-of-uninitialized-value Crash state: icalmemorystrdup icaltimezoneinitbuiltintimezones icaltimezonegetutctimezone...
PT-2025-5661 · Git +1 · Libical
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the following sequence: icalmemory strdup, icaltimezone...
CVE-2024-6001
creationtimestamp| type| source ---|---|--- 2024-12-16 19:02:34+00:00| seen| https://t.me/cvedetector/13017...
DLA-3972-1 tzdata - new timezone database
Bulletin has no description...
The vulnerability of the FUN_0044db3c function (/goform/fast_setting_wifi_set) in the Tenda AC10 router’s microprogramming system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the FUN0044db3c function /goform/fastsettingwifiset of the Tenda AC10 router’s microprogramming software is related to buffer overflow in the stack when processing the timeZone parameter. Exploiting this vulnerability can allow an attacker to compromise the confidentiality,...
SUSE-SU-2024:4006-1 Security update for SUSE Manager Server 4.3
This update fixes the following issues: cobbler: - Security issues fixed: CVE-2024-47533: Prevent privilege escalation from none to admin bsc1231332 - Other bugs fixed: Increase start timeout for cobblerd unit bsc1219450 Provide syncsinglesystem for DHCP modules to improve performance bsc1219450...
CVE-2024-11061
A vulnerability classified as critical was found in Tenda AC10 16.03.10.13. Affected by this vulnerability is the function FUN0044db3c of the file /goform/fastsettingwifiset. The manipulation of the argument timeZone leads to stack-based buffer overflow. The attack can be launched remotely. The...
Tenda AC10 安全漏洞
The Tenda AC10 is an 11ac dual band router designed for homes with 200 megabit and above fiber. A stack buffer overflow vulnerability exists in the Tenda AC10. The vulnerability stems from a stack-based buffer overflow caused by the parameter timeZone in the FUN0044db3c function of the...
OPENSUSE-SU-2024:0351-1 Security update for python-mysql-connector-python
This update for python-mysql-connector-python fixes the following issues: - Update to 9.1.0 boo1231740, CVE-2024-21272 - WL16452: Bundle all installable authentication plugins when building the C-extension - WL16444: Drop build support for DEB packages - WL16442: Upgrade gssapi version to 1.8.3 -...
CVE-2024-10266
creationtimestamp| type| source ---|---|--- 2024-10-29 13:05:54+00:00| seen| https://t.me/cvedetector/9289...
The vulnerability of the formEasySetTimezone function (/goform/formEasySetTimezone) in the D-Link DIR-619L router software allows a hacker to trigger a service failure.
The vulnerability of the formEasySetTimezone function /goform/formEasySetTimezone of the D-Link DIR-619L router’s software lies in the copying of buffer without checking the size of the input data during the processing of the curTime parameter. Exploiting this vulnerability could allow an attacke...
CVE-2024-9570
A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formEasySetTimezone of the file /goform/formEasySetTimezone. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit...
PT-2024-37925 · WordPress · Event Espresso 4 Decaf
Name of the Vulnerable Software and Affected Versions: Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress versions up to, and including, 5.0.22.decaf Description: The issue is related to a missing capability check on the saveTimezoneString and some other functions,...
PT-2024-24989 · Grandstream · Grandstream Gxp2135
Name of the Vulnerable Software and Affected Versions: Grandstream GXP2135 versions 1.0.9.129 through 1.0.11.79 Description: An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality. A specially crafted network packet can lead to arbitrary command execution. An...
GHSA-4RCH-2FH8-94VW MySQL2 for Node Arbitrary Code Injection
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function...
CVE-2024-21511
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function...
CVE-2024-21511
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function...