CVE-2024-7874 XSS in Tungsten Automation TotalAgility

Tungsten Automation Kofax TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpConnectionId parameter manipulation in a form sent to endpoints "/TotalAgility/Kofax/BrowserDevice/ScanFront.aspx"...

The vulnerability of the formSetDebugCfg function in the wireless access point software Tenda G3 allows a hacker to execute arbitrary code.

The vulnerability of the formSetDebugCfg function in the wireless access point software Tenda G3 is related to buffer overflows based on a stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code by sending specially crafted POST requests...

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from the use of a regular expression c with inefficient computational complexity, allowing a hacker to trigger a service failure.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures whe...

Epson Express Home XP255 安全漏洞

The Epson Express Home XP255 is a printer from Epson Japan. A security vulnerability exists in the Epson Express Home XP255 version 20.08, which stems from a failure to validate the legitimacy of a POST request via a CSRF token or other mechanism, making it susceptible to cross-site request forge...

CVE-2019-20460

Affects Epson Expression Home XP255 20.08.FM10I8. Root cause: POST to RAW printer interface lacks CSRF validation, enabling CSRF attacks to send text to the RAW interface and potentially print unwanted content. Impact is described as high (C/H/I/A) per CVSS 3.1. Remediation available in connected...

CVE-2019-20460

An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. POST requests don't require anti-CSRF tokens or other mechanisms for validating that the request is from a legitimate source. In addition, CSRF attacks can be used to send text directly to the RAW printer interface. For...

PT-2024-10736 · Epson · Epson Expression Home Xp255

Name of the Vulnerable Software and Affected Versions: Epson Expression Home XP255 version 20.08.FM10I8 Description: An issue was discovered where POST requests do not require anti-CSRF tokens or other mechanisms for validating that the request is from a legitimate source. This allows for CSRF...

CVE-2024-52016

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilities in the component wlgadv.cgi via the apmodedns1pri and apmodedns1sec parameters. These vulnerabilities allow attackers to cause a Denial of Service DoS vi...

CVE-2024-51004

Netgear R8500 v1.0.2.160 and R7000P v1.3.3.154 were discovered to multiple stack overflow vulnerabilities in the component usbdevice.cgi via the cifsuser, readaccess, and writeaccess parameters. These vulnerabilities allow attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-51003

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilities in the component apmode.cgi via the apmodedns1pri and apmodedns1sec parameters. These vulnerabilities allow attackers to cause a Denial of Service DoS vi...

The vulnerability of the formSetRebootTimer function (/goform/SetSysAutoRebbotCfg) in the Tenda AC8 router’s microprogramming system allows a intruder to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the compareparentcontroltime function /goform/saveParentControlInfo in the Tenda AC8 router’s microprogramming system is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

PT-2024-8387 · NetGear · Netgear R8500 +1

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Netgear R7000P version 1.3.3.154 Description: The issue is related to multiple stack overflow vulnerabilities in the usb device.cgi component of Netgear routers. These vulnerabilities can be exploited via the...

CVE-2024-20408

A vulnerability in the Dynamic Access Policies DAP feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly. To exploit this vulnerability, an attacker...

CVE-2024-20408

A vulnerability in the Dynamic Access Policies DAP feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly. To exploit this vulnerability, an attacker...

CVE-2024-20408

A vulnerability in the Dynamic Access Policies DAP feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly. To exploit this vulnerability, an attacker...

PT-2024-7457 · Cisco · Cisco Asa +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: The issue is related to improper validation of data in HTTPS POST requests...

The vulnerability of the SetVirtualServerSettings() function in the prog.cgi script of D-Link DIR-878 and DIR-882 router microprogramming systems allows a hacker to execute arbitrary commands.

The vulnerability of the SetVirtualServerSettings function in the prog.cgi script of D-Link DIR-878 and DIR-882 routers exists due to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious actor to execute...

SUSE SLES12: apache2-mod_php74 / php74 / php74-bcmath / php74-bz2 / etc (SUSE-SU-2024:3732-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3732-1 advisory. - CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed...

SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2024:3733-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3733-1 advisory. - CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not...

CVE-2024-48634

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...