CVE-2023-6799 WP Reset <= 2.0 - Sensitive Information Exposure due to Insufficient Randomness

The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 via the use of insufficiently random snapshot names. This makes it possible for unauthenticated attackers to extract sensitive data...

CVE-2023-49074

A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926. A specially crafted series of network requests can lead to reset to factory settings. An attacker can send a sequence of unauthenticated...

CVE-2023-49074

CVE-2023-49074 affects TP-Link AC1350 Omada Giga APs (EAP225 V3) running v5.1.0 Build 20220926. A TDDP-based vulnerability (V2 ENC_CMD_OPT subtype 0x49) allows an unauthenticated attacker to reset device settings to factory defaults by sending a crafted network request; a related TDDP_SPECIAL_CMD...

CVE-2023-49074

A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926. A specially crafted series of network requests can lead to reset to factory settings. An attacker can send a sequence of unauthenticated...

SUSE CVE-2024-26801

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hcierrorreset While handling the HCIEVHARDWAREERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would free the hcidev and lead to a use-after-fre...

CVE-2024-27983

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a T...

CVE-2024-27983

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a T...

PT-2024-27220

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue arises when multiple devices are reset in parallel. The first device calls kfd suspend all processes to evict all processes on all devices, but this call takes time to finish...

WordPress Plugin WP Reset 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...

PT-2024-18434 · WordPress · Wp Compress

Name of the Vulnerable Software and Affected Versions: WP Compress – Image Optimizer plugin for WordPress versions up to, and including, 6.11.10 Description: The issue allows unauthorized modification of data due to a missing capability check on the wps local compress:: construct function. This...

TP-LINK AC1350 安全漏洞

The TP-LINK AC1350 is a router from China P&L TP-LINK. The TP-LINK AC1350 suffers from a security vulnerability that can be exploited by an attacker to cause a reset to factory settings via a series of specially crafted network requests...

Ubuntu: Security Advisory (USN-6722-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) TDDP denial of service vulnerability

Talos Vulnerability Report TALOS-2023-1861 Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 TDDP denial of service vulnerability April 9, 2024 CVE Number CVE-2023-49074 SUMMARY A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO...

CVE-2024-28270

An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword...

USN-6722-1 python-django vulnerability

Simon Charette discovered that the password reset functionality in Django used a Unicode case insensitive query to retrieve accounts associated with an email address. An attacker could possibly use this to obtain password reset tokens and hijack accounts...

USN-6722-1: Django vulnerability

Simon Charette discovered that the password reset functionality in Django used a Unicode case insensitive query to retrieve accounts associated with an email address. An attacker could possibly use this to obtain password reset tokens and hijack accounts...

PT-2024-26809 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue arises when the driver attempts to perform a PCI reset on itself via pci reset function in the context of the driver's health thread, while pdsc reset prepare calls pdsc stop...

PT-2024-22373 · Web-Flash · Web-Flash

Name of the Vulnerable Software and Affected Versions: web-flash version 3.0 Description: An issue in web-flash allows attackers to reset passwords for arbitrary users via a crafted POST request to "/prod-api/user/resetPassword". Recommendations: For web-flash version 3.0, consider disabling the...

The vulnerability of microprogrammed communication module software for SIMATIC CP 343-1, SIMATIC CP 343-1 Lean, SIPLUS NET CP 343-1, and SIPLUS NET CP 343-1 Lean arises from insufficient verification of the communication channel source. This vulnerability allows attackers to trigger service failures.

The vulnerability of microprogrammed communication module software for SIMATIC CP 343-1, SIMATIC CP 343-1 Lean, SIPLUS NET CP 343-1, and SIPLUS NET CP 343-1 Lean is related to insufficient verification of the communication channel source. Exploiting this vulnerability can allow a malicious actor ...

web-flash 安全漏洞

web-flash is an enilu open source web system based on Spring Boot and Vue.js. A security vulnerability exists in web-flash version v3.0, which originated from a vulnerability that allows an attacker to reset an arbitrary user's password via a crafted POST request...