CVE-2023-48185

CVE-2023-48185 affects TerraMaster NAS firmware versions v.s1.0 through v.2.295. It is a Directory Traversal vulnerability that allows a remote attacker to obtain sensitive information via a crafted GET request. The NVD entry shows CVSS v3.1 base score 7.5 (Network, Low attack complexity, No priv...

CVE-2023-48185

Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive information via a crafted GET request...

PT-2023-30672 · Liblisp · Liblisp

Name of the Vulnerable Software and Affected Versions: Liblisp versions through commit 4c65969 Description: The issue is related to an out-of-bounds-read vulnerability in the get length function, which is located in the eval.c file and operates on lisp cell t objects. This vulnerability can be...

CVE-2023-38316

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt...

openNDS Security Vulnerabilities

openNDS is openNDS open source a high-performance, small footprint portal system. A security vulnerability exists in versions of openNDS prior to 10.1.2 that originates from an attacker being able to execute an arbitrary operating system command by inserting it into the URL portion of an HTTP GET...

CVE-2023-38316

Summary: CVE-2023-38316 affects OpenNDS Captive Portal prior to v10.1.2. When the custom unescape callback is enabled, an attacker can execute arbitrary OS commands by placing them in the URL portion of HTTP GET requests. The issue is fixed in OpenNDS to v10.1.3, with patches in OpenWrt master, O...

CVE-2023-38313

An issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a dobinauth NULL pointer dereference that can be triggered with a crafted GET HTTP request with a missing client redirect query string parameter. Triggering this issue results in crashing openNDS a Denial-of-Service condition...

CVE-2023-41101

An issue was discovered in the captive portal in OpenNDS before version 10.1.3. getquery in httpmicrohttpd.c does not validate the length of the query string of GET requests. This leads to a stack-based buffer overflow in versions 9.x and earlier, and to a heap-based buffer overflow in versions...

OpenNDS Buffer Error Vulnerability

openNDS is openNDS open source a high-performance , small footprint portal system . A buffer error vulnerability exists in versions of OpenNDS prior to 10.1.3, which stems from not validating the length of a query string for a GET request, and can lead to a stack-based buffer overflow that can be...

CVE-2023-38316

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt...

CVE-2023-38316

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt...

H2O local file inclusion vulnerability

A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...

CVE-2023-6038

A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...

CVE-2023-6038 Local File Inclusion in h2oai/h2o-3

A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...

CVE-2023-6038 Local File Inclusion in h2oai/h2o-3

A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...

PT-2023-7585 · Tenda · Tenda I6

Name of the Vulnerable Software and Affected Versions: Tenda i6 version 1.0.0.83856 Description: The issue is related to a buffer overflow in the /goform/wifiSSIDget component of the Tenda i6 wireless access point's firmware. This occurs when the index parameter is processed, allowing a remote...

PublicCMS Security Vulnerabilities

PublicCMS is an open source content management system CMS written in Java by PublicCMS China. A security vulnerability exists in PublicCMS version v.4.0.202302.e, which stems from the presence of a Server Request Forgery SSRF vulnerability. An attacker can exploit the vulnerability to obtain...

CVE-2023-43979

ETS Soft ybcblog before v4.4.0 was discovered to contain a SQL injection vulnerability via the component YbcblogBlogModuleFrontController::getPosts...

Ray cpu_profile command injection

Ray RCE via cpuprofile command injection vulnerability. Module Options msf use exploit/linux/http/ray/cpuprofilecmdinjectioncve20236019 msf undefinedcpuprofilecmdinjectioncve20236019 show actions ...actions... msf undefinedcpuprofilecmdinjectioncve20236019 set ACTION msf...

kernel: tpm: acpi: Call acpi_put_table() to fix memory leak

In the Linux kernel, the following vulnerability has been resolved: tpm: acpi: Call acpiputtable to fix memory leak The start and length of the event log area are obtained from TPM2 or TCPA table, so we call acpigettable to get the ACPI information, but the acpigettable should be coupled with...