CVE-2024-46982

Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router this does not affect the app router. When this crafted request is sent it could coerce Next....

Apache Seata 代码问题漏洞

Apache Seata is an open source distributed transaction solution , is committed to providing high performance and easy to use distributed transaction services in the microservices architecture . Apache Seata suffers from a deserialization vulnerability that can be exploited by a remote attacker to...

CVE-2024-44072

CVE-2024-44072 affects BUFFALO Wireless LAN routers and wireless LAN repeaters. An authenticated user can trigger an OS command injection (CWE-78) by sending a crafted request from the product’s management page, potentially executing arbitrary commands on the device. Affected products/versions (p...

Exploit for CVE-2024-7954

Description The porteplume plugin used by SPIP before 4.30-...

Supra Smart Cloud TV Remote File Inclusion

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Supra Smart Cloud TV Remote File Inclusion', 'Description' = %q This module exploits an unauthenticated remote file inclusion which exists in Sup...

ManageEngine Desktop Central Administrator Account Creation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine Desktop Central Administrator Account Creation', 'Description' = %q This module exploits an administrator account creation...

Canon Wireless Printer Denial Of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Canon Wireless Printer Denial Of Service', 'Description' = %q The HTTP management interface on several models of Canon Wireless printers allows f...

The vulnerability of the virtual learning environment Moodle, which exists due to the lack of measures taken to protect the structure of the web page, allows a hacker to execute arbitrary code.

The vulnerability in the virtual learning environment Moodle exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by creating a specially crafted request...

EQ Enterprise Management System 安全漏洞

EQ Enterprise Management System is an enterprise management system from China-based EQ. A security vulnerability exists in EQ Enterprise Management System version v2.0.0. An attacker performs directory traversal via a crafted request...

TOTOLINK AC1200 安全漏洞

The TOTOLINK AC1200 T8 is a dual-band full gigabit router from China's Gion Electronics TOTOLINK. The TOTOLINK AC1200 T8 suffers from a buffer overflow vulnerability that can be exploited by an attacker to submit a special request that can crash the service program or execute arbitrary code...

Apollo 安全漏洞

Apollo is an Apollo open source configuration management system. A security vulnerability exists in Apollo version 2.2.0 that originates from a remote attacker who can obtain sensitive information via a specially crafted request...

CVE-2024-42662

An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request...

Schneider Electric Accutech Manager 安全漏洞

Schneider Electric Accutech Manager is a platform that provides field device and base radio performance data in an easy-to-use interface from Schneider Electric, France. A security vulnerability exists in Schneider Electric Accutech Manager version 2.8.0.0 and prior versions, which stems from a...

CVE-2024-42662

CVE-2024-42662 affects apollocongif apollo version 2.2.0. The issue allows a remote attacker to obtain sensitive information via a crafted request, impacting confidentiality (per CVSS 3.1: High, Network, no user interaction). Concrete root cause, affected files, or patched versions are not detail...

CVE-2024-42986

Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-42947

An issue in the handler function in /goform/telnet of Tenda FH1201 v1.2.0.14 408 allows attackers to execute arbitrary commands via a crafted HTTP request...

CVE-2024-42967

Incorrect access control in TOTOLINK LR350 V9.3.5u.6369B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh...

CVE-2024-42967

Incorrect access control in TOTOLINK LR350 V9.3.5u.6369B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh...

CVE-2024-42966

The CVE-2024-42966 issue affects TOTOLINK N350RT (V9.3.5u.6139_B20201216). The root cause is incorrect access control on /cgi-bin/ExportSettings.sh, enabling retrieval of the apmib configuration file that stores credentials (username/password). The vulnerability impact is described as high confid...

CVE-2024-42976

Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...