CVE-2018-17005

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for firewall dmz enable...

Design/Logic Flaw

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for protocol wan wanrate...

CVE-2018-17006

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for firewall lanmanage mac2...

CVE-2018-17018

CVE-2018-17018 affects TP-Link TL-WR886N devices (versions 6.0 2.3.4 and 7.0 1.1.0). Authenticated attackers can crash router services (inetd, HTTP, DNS, UPnP) by sending long JSON data for the time_switch name. The impact described is partial availability loss of those services. The available so...

CVE-2018-17007

CVE-2018-17007 affects TP-Link TL-WR886N devices (versions 6.0 2.3.4 and 7.0 1.1.0). Authenticated attackers can crash router services (inetd, HTTP, DNS, UPnP) by sending unusually long JSON data to the wireless wlan_wds_2g SSID. CVSS data from NVD indicates Network attack, Low complexity, Privil...

CVE-2018-17013

TP-Link TL-WR886N devices (versions 6.0 2.3.4 and 7.0 1.1.0) are affected by a Denial of Service flaw where authenticated attackers can crash router services (inetd, HTTP, DNS, UPnP) by sending long JSON data to the protocol wan wan_rate. The issue arises in the handling of the wan_rate field, ac...

CVE-2018-17004

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for wlanaccess name...

CVE-2018-17004

CVE-2018-17004 affects TP-Link TL-WR886N devices, specifically version 6.0 2.3.4 and 7.0 1.1.0. The issue allows authenticated attackers to crash router services (inetd, HTTP, DNS, UPnP) by sending long JSON data for the wlan_access name. This can impact availability of router services (as indica...

CVE-2018-17012

The CVE-2018-17012 issue affects TP-Link TL-WR886N devices (firmware versions 6.0 2.3.4 and 7.0 1.1.0). The root cause involves processing of long JSON data for hosts_info set_block_flag up_limit, which can cause authenticated attackers to crash router services such as inetd, HTTP, DNS, and UPnP....

CVE-2018-17006: Undefined Security Weakness

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for firewall lanmanage mac2...

CVE-2018-17010: Undefined Security Weakness

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for wireless wlanhost2g bandwidth...

CVE-2018-17017: Undefined Security Weakness

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for dhcpd udhcpd enable...

CVE-2018-17016: Undefined Security Weakness

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for reboottimer name...

CVE-2016-9044

An exploitable command execution vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal 8.1 . A specially crafted web parameter can cause a command injection. An authenticated attacker can send a crafted web request to trigger this vulnerability...

CVE-2016-9044: Improper Neutralization of Special Elements used in a Command

An exploitable command execution vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal 8.1 . A specially crafted web parameter can cause a command injection. An authenticated attacker can send a crafted web request to trigger this vulnerability...

CVE-2018-0644: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in Ubuntu14.04 ORCA Online Receipt Computer Advantage 4.8.0 panda-client2 1:1.4.9+p41-u4jma1 and earlier, Ubuntu14.04 ORCA Online Receipt Computer Advantage 5.0.0 panda-client2 1:2.0.0+p48-u4jma1 and earlier, and Ubuntu16.04 ORCA Online Receipt Computer Advantage 5.0.0 panda-clien...

CVE-2018-1000658: Unrestricted Upload of File with Dangerous Type

LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell. This attack appear to be exploitable via an authenticated user uploading a zip archive which can contains malicious php files that ca...

CVE-2018-10907

It was found that glusterfs server is vulnerable to mulitple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers using 'alloca3'. An authenticated attacker could exploit this by mounting a gluster volume and sending a string longer that the fixed buffe...

CVE-2018-10930: Improper Input Validation

A flaw was found in RPC request using gfs3renamereq in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the gluster volume...

CVE-2018-15480: Undefined Security Weakness

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. The cloud API had a hidden parameter, which allowed an authenticated...