iboss Secure Web Gateway - Stored Cross-Site Scripting Vulnerability

Exploit Title: iboss Secure Web Gateway - Stored Cross-Site Scripting XSS Exploit Author: modrnProph3t Vendor Homepage: https://www.iboss.com Version: userName=TEST&x=TEST&action=login&redirectUrl= 3. Insert XSS payload into the "redirectUrl" parameter Example of request with inserted payload: PO...

CVE-2024-30973

An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitive information via crafted POST request to /boaform/getASPdata/formFirewall, /boaform/getASPdata/formAcc...

The vulnerability of the sub_42CB94() function (/goform/SetVirtualServerCfg) in the Tenda TX9 Pro router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sub42CB94 function /goform/SetVirtualServerCfg of the Tenda TX9 Pro router software is related to the operation of writing data beyond the buffer in memory when processing the list parameter. Exploiting this vulnerability allows an attacker to compromise the...

The vulnerability of the formOfflineSet (/goform/setStaOffline) function in the Tenda i21 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formOfflineSet /goform/setStaOffline function in the Tenda i21 router microprogramming software is related to buffer overflow during the processing of the GO/ssidIndex parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity...

The vulnerability of the formGetDiagnoseInfo function in Tenda i21 router microprogramming software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formGetDiagnoseInfo function in Tenda i21 router microprogramming software is related to buffer overflow during the processing of the cmdinput parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of...

CVE-2024-30973

An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitive information via crafted POST request to /boaform/getASPdata/formFirewall, /boaform/getASPdata/formAcc...

The vulnerability of the formWifiMacFilterGet function in Tenda i21 router microprogramming software allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formWifiMacFilterGet function in Tenda i21 router microprogramming software is related to buffer overflow in the stack when processing the index parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of...

The vulnerability of the formSetUplinkInfo function (/goform/setUplinkInfo) in the Tenda i21 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetUplinkInfo /goform/setUplinkInfo function in the Tenda i21 router microprogramming software is related to buffer overflow during the processing of the pingHostIp2 parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality,...

The vulnerability of the sub_42C014() function (/goform/PowerSaveSet) in the Tenda TX9 Pro router’s microprogramming system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sub42C014 function /goform/PowerSaveSet of the Tenda TX9 Pro router’s microprogramming software is related to the execution of operations outside the buffer in memory when processing the time parameter. Exploiting this vulnerability can allow an attacker to compromise the...

Zebra ZTC Industrial ZT400 and ZTC Desktop GK420d Authentication Bypass Using an Alternate Path or Channel (CVE-2023-4957)

A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in the same network as the printer, to change the username and password for the Web Page by sending a specially crafted POST request to the...

CVE-2024-34502

An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will attempt to make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit...

CVE-2024-34502

CVE-2024-34502 affects WikibaseLexeme in MediaWiki up to specific versions: before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. The flaw allows Special:MergeLexemes to trigger an edit merging the from-id into the to-id even when the request is not POST and lacks an edit token, effectiv...

aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests

Summary An attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. Impact An attacker can stop the application from serving requests after sending a single...

CVE-2024-27453

Summary: CVE-2024-27453 affects Extreme XOS up to version 22.6.1.4. A read-only user can escalate to root by sending a crafted HTTP POST to the Machine-to-Machine Interface (MMI) Python method. This is a network-accessible vulnerability with no user interaction required. Affected software/area: E...

SOPlanning 1.52.00 SQL Injection

Exploit Title: SOPlanning v1.52.00 'projets.php' SQLi Application: SOPlanning Version: 1.52.00 Date: 4/22/24 Exploit Author: Joseph McPeters Liquidsky Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/ Tested on: Linux CVE: Not yet assigned...

PT-2024-21906 · Extreme · Extremexos

Name of the Vulnerable Software and Affected Versions: Extreme XOS versions 22.6.1.4 and earlier Description: A read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machine Interface MMI. Recommendations: For Extreme XOS versions...

CVE-2024-27453

In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machine Interface MMI...

HackerOne: Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json Endpoint

The Insecure Direct Object Reference IDOR vulnerability allowed viewing private report details through the /bugs.json endpoint. Any private reports could be accessed by sending a POST request to the endpoint with the organization ID and a single-digit text query. This gave access to sensitive...

CVE-2024-30251

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further request...

CVE-2024-30251

CVE-2024-30251 affects aio-libs aiohttp. An attacker can send a specially crafted POST (multipart/form-data) request and the aiohttp server may enter an infinite loop while processing it, causing a denial of service. The issue is addressed in a patched version (3.9.4); remediation is to upgrade t...