CVE-2024-50585

Users who click on a malicious link or visit a website under the control of an attacker can be infected with arbitrary JavaScript which is running in the context of the "Numerix License Server Administration System Login" nlslogin.jsp page. The vulnerability can be triggered by sending a speciall...

CVE-2024-50585

CVE-2024-50585 affects the Numerix License Server (Numerix, Inc.). Users who click a malicious link or visit an attacker-controlled site can have arbitrary JavaScript executed in the context of the Numerix License Server Administration System Login (nlslogin.jsp) page. The vulnerability can be tr...

CVE-2024-11491

A vulnerability was found in 115cms up to 20240807. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php/admin/web/useradmin.html. The manipulation of the argument ks leads to cross site scripting. The attack may be launched remotely. The...

CVE-2024-8075

The vulnerability CVE-2024-8075 affects TOTOLINK AC1200 T8 (version 4.1.5cu.862_B20230228). The issue resides in the setDiagnosisCfg function and enables OS command injection, with remote, network-exposed exploitation. Several connected sources confirm the impact and vendor non-response; remediat...

CVE-2024-7463

CVE-2024-7463 affects TOTOLINK CP900 (v6.3c.566). The vulnerability is in the UploadCustomModule function of /cgi-bin/cstecgi.cgi, where unsafely handling the File parameter leads to a buffer overflow. This allows remote exploitation and could enable arbitrary code execution or device compromise....

CVE-2024-7214

The CVE-2024-7214 entry concerns TOTOLINK LR350 firmware (version 9.3.5u.6369_B20220309). The vulnerability is a command-injection flaw in the setWanCfg function of /cgi-bin/cstecgi.cgi, triggered by manipulating the hostName parameter. Root cause: insufficient input filtering for constructed com...

CVE-2024-7117

A vulnerability classified as critical has been found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected is an unknown function of the file /shiftviewmore.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2024-6402

A vulnerability classified as critical was found in Tenda A301 15.13.08.12. Affected by this vulnerability is the function fromSetWirelessRepeat of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack can be launched remotely...

CVE-2024-4117

A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical. Affected by this issue is the function formDelPortMapping of the file /goform/DelPortMapping. The manipulation of the argument portMappingIndex leads to stack-based buffer overflow. The attack may be launched remotely...

CVE-2024-3765

A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530R80X30-PQ8M. Affected by this vulnerability is an unknown functionality of the component Sofia Service. The manipulation with the input...

CVE-2024-3146 DedeCMS makehtml_rss_action.php cross-site request forgery

A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/makehtmlrssaction.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and...

CVE-2024-3024

A vulnerability was found in appneta tcpreplay up to 4.4.4. It has been classified as problematic. This affects the function getlayer4v6 of the file /tcpreplay/src/common/get.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclose...

CVE-2024-3011 Tenda FH1205 QuickIndex formQuickIndex stack-based overflow

A vulnerability was found in Tenda FH1205 2.0.0.7775. It has been classified as critical. This affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to initiate the attack remotely. T...

CVE-2024-2894

The CVE-2024-2894 entry affects Tenda AC7, specifically the stack-based buffer overflow in the function formSetQosBand within /goform/SetNetControlList (version 15.03.06.44). The vulnerability can be triggered remotely by manipulating the list argument, leading to potential full confidentiality, ...

CVE-2024-2820 DedeCMS baidunews.php cross-site request forgery

A vulnerability classified as problematic was found in DedeCMS 5.7. Affected by this vulnerability is an unknown functionality of the file /src/dede/baidunews.php. The manipulation of the argument filename leads to cross-site request forgery. The attack can be launched remotely. The exploit has...

Sql injection

A vulnerability classified as critical has been found in boyiddha Automated-Mess-Management-System 1.0. Affected is an unknown function of the file /member/view.php. The manipulation of the argument date leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2024-1817

A vulnerability has been found in Demososo DM Enterprise Website Building System up to 2022.8 and classified as critical. Affected by this vulnerability is the function dmlogin of the file indexDMload.php of the component Cookie Handler. The manipulation of the argument isadmin with the input y...

CVE-2024-0997 Totolink N200RE cstecgi.cgi setOpModeCfg stack-based overflow

A vulnerability was found in Totolink N200RE 9.3.5u.6139B20201216 and classified as critical. Affected by this issue is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument pppoeUser leads to stack-based buffer overflow. The attack may be launched remotely...

CVE-2023-7094

A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown functionality of the file /protocol/nsasg6.0.tgz. The manipulation leads to information disclosure. The attack can be launched remotely. The explo...

Design/Logic Flaw

A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/. The manipulation leads to direct request. The exploit has been disclosed to the public and may be used. The identifier of th...