CVE-2024-4125

CVE-2024-4125 – Tenda W15E Affected: Tenda W15E router, version 15.11.0.14. Vulnerable component: the function formSetStaticRoute in file /goform/setStaticRoute. Root cause: manipulation of the staticRouteIndex argument leads to a stack-based buffer overflow. Impact: enables remote execution with...

CVE-2024-4124 Tenda W15E SetRemoteWebManage formSetRemoteWebManage stack-based overflow

A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14. This affects the function formSetRemoteWebManage of the file /goform/SetRemoteWebManage. The manipulation of the argument remoteIP leads to stack-based buffer overflow. It is possible to initiate the attack...

CVE-2024-4122

CVE-2024-4122 affects Tenda W15E (firmware 15.11.0.14). Affects the function formSetDebugCfg in /goform/setDebugCfg; manipulating enable/level/module causes a stack-based buffer overflow. The vulnerability can be exploited remotely and exploit details have been published. Multiple connected sourc...

CVE-2024-4119

The CVE-2024-4119 entry concerns the Tenda W15E router (firmware 15.11.0.14). The vulnerability is in the function formIPMacBindDel (file /goform/delIpMacBind) where improper validation of the IPMacBindIndex input leads to a stack-based buffer overflow. It is exploitable remotely and, per sources...

CVE-2024-4116 Tenda W15E DelDhcpRule formDelDhcpRule stack-based overflow

A vulnerability has been found in Tenda W15E 15.11.0.14 and classified as critical. Affected by this vulnerability is the function formDelDhcpRule of the file /goform/DelDhcpRule. The manipulation of the argument delDhcpIndex leads to stack-based buffer overflow. The attack can be launched...

Cisco Adaptive Security Appliance and Firepower Threat Defense Software Command Injection Vulnerability

A vulnerability in the Cisco Adaptive Security Appliance ASA restore functionality that is available in Cisco ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level...

CVE-2024-4115 Tenda W15E AddDnsForward formAddDnsForward stack-based overflow

A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14. Affected is the function formAddDnsForward of the file /goform/AddDnsForward. The manipulation of the argument DnsForwardRule leads to stack-based buffer overflow. It is possible to launch the attack remotely...

CVE-2024-4112

CVE-2024-4112 affects Tenda TX9 v22.03.02.10, specifically the sub_42CB94 function in /goform/SetVirtualServerCfg. The issue is a stack-based buffer overflow caused by handling the list parameter, allowing remote exploitation. Public disclosures exist and the vulnerability is tracked under VDB-26...

CVE-2024-4064

A vulnerability was found in Tenda AC8 16.03.34.09. It has been declared as critical. This vulnerability affects the function R7WebsSecurityHandler of the file /goform/execCommand. The manipulation of the argument password leads to stack-based buffer overflow. The attack can be initiated remotely...

CVE-2024-4064 Tenda AC8 execCommand R7WebsSecurityHandler stack-based overflow

A vulnerability was found in Tenda AC8 16.03.34.09. It has been declared as critical. This vulnerability affects the function R7WebsSecurityHandler of the file /goform/execCommand. The manipulation of the argument password leads to stack-based buffer overflow. The attack can be initiated remotely...

CVE-2024-4064

CVE-2024-4064 affects Tenda AC8 16.03.34.09. The R7WebsSecurityHandler function in /goform/execCommand mishandles the password parameter, causing a stack-based buffer overflow. This enables remote exploitation; the exploit has been disclosed publicly. Multiple sources (NVD, Red Hat, CNVD, CNNVD, ...

CVE-2024-4063

CVE-2024-4063 affects EZVIZ CS-C6-21WFR-8 running version 5.2.7 Build 170628, with the Davinci Application component showing improper certificate validation. The vulnerability enables remote initiation of an attack, though attack complexity is described as high and exploitability as difficult. Th...

RHEL 6 / 7 : php54 (RHSA-2015:1066)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1066 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The php54 packages provide a recent stable release...

Exploit for CVE-2023-51119

CVE-2023-51119 Improper Access Control on D-Link DIR-605L rout...

CVE-2024-4020

The connected documents confirm CVE-2024-4020 affects Tenda FH1206 firmware version 1.2.0.8(8155). The vulnerability targets the fromAddressNat function in /goform/addressNat, where improper handling of the entrys parameter leads to a buffer overflow. Exploitation is described as remote and has b...

CVE-2024-4019

A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411. Affected is an unknown function of the file /importhtml.php. The manipulation of the argument sql leads to deserialization. It is possible to launch the attack remotely. The exploit has...

CVE-2024-4019

CVE-2024-4019 affects Byzoro Smart S80 Management Platform (up to 20240411). The vulnerability is in an unknown function of /importhtml.php, where manipulation of the sql argument leads to deserialization. It enables a remote attack and the exploit has been disclosed publicly. Multiple sources (N...

CVE-2024-31993 Mealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227)

Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the scrapeimage function will retrieve an image based on a user-provided URL, however the provided URL is not validated to point to an external location and does not have any enforced rate limiting. The response from the...

CVE-2024-31991 Mealie vulnerable to a GET-based SSRF in recipe importer (GHSL-2023-225)

Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safescrapehtml function utilizes a user-controlled URL to issue a request to a remote server. Based on the content of the response, it will either parse the content or disregard it. This function, nor those that call it,...

CVE-2023-50260

Wazuh is a free and open source platform used for threat prevention, detection, and response. A wrong validation in the hostdeny script allows to write any string in the hosts.deny file, which can end in an arbitrary command execution on the target system. This vulnerability is part of the active...