CVE-2024-3907

CVE-2024-3907 affects Tenda AC500 2.0.1.9(1307). The vulnerability is in the formSetCfm function of /goform/setcfm, where manipulating the funcpara1 argument triggers a stack-based buffer overflow. It is a network‑bound issue with remote potential; the exploit has been disclosed publicly. Public ...

CVE-2024-3906 Tenda AC500 QuickIndex formQuickIndex stack-based overflow

A vulnerability was found in Tenda AC500 2.0.1.91307. It has been declared as critical. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack can be initiated remotely...

CVE-2024-3906

CVE-2024-3906 affects Tenda AC500 (version 2.0.1.9(1307)) via the formQuickIndex function in /goform/QuickIndex. The root cause is a stack-based buffer overflow triggered when the PPPOEPassword parameter is manipulated, enabling remote exploitation. Publicized exploit details indicate in-the-wild...

Peplink Smart Reader web interface /cgi-bin/debug_dump.cgi information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1863 Peplink Smart Reader web interface /cgi-bin/debugdump.cgi information disclosure vulnerability April 17, 2024 CVE Number CVE-2023-43491 SUMMARY An information disclosure vulnerability exists in the web interface /cgi-bin/debugdump.cgi functionality of...

Ubuntu 16.04 LTS / 18.04 LTS : Apache HTTP Server vulnerabilities (USN-6729-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6729-2 advisory. USN-6729-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS...

PT-2024-14803 · Unknown · Cda Server

Name of the Vulnerable Software and Affected Versions: CDA Server affected versions not specified Description: A server information leak can occur in the CDA Server process memory when an error is generated in response to a specially crafted message. Recommendations: At the moment, there is no...

CVE-2024-3882

A vulnerability was found in Tenda W30E 1.0.1.25633. It has been classified as critical. Affected is the function fromRouteStatic of the file /goform/fromRouteStatic. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The...

CVE-2024-3881

Summary: CVE-2024-3881 affects Tenda W30E 1.0.1.25(633). A stack-based buffer overflow exists in the frmL7PlotForm function of /goform/frmL7ProtForm caused by improper handling of the page parameter. This can be exploited remotely and an exploit has been disclosed publicly. Impact: Confidentialit...

CVE-2024-3879

A vulnerability, which was classified as critical, was found in Tenda W30E 1.0.1.25633. This affects the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has...

CVE-2024-3880

A vulnerability has been found in Tenda W30E 1.0.1.25633 and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. The attack can be initiated remotely. The exploit has...

CVE-2024-3877

A vulnerability classified as critical was found in Tenda F1202 1.2.0.20408. Affected by this vulnerability is the function fromqossetting of the file /goform/fromqossetting. The manipulation of the argument qos leads to stack-based buffer overflow. The attack can be launched remotely. The exploi...

CVE-2024-3880

The CVE-2024-3880 issue affects Tenda W30E devices, specifically the formWriteFacMac function in /goform/WriteFacMac. The vulnerability arises from improper handling of the mac parameter, enabling os command injection. It is a network(remote) vector with low privileges required and no user intera...

CVE-2024-3878

CVE-2024-3878 affects Tenda F1202, firmware version 1.2.0.20(408). The vulnerability exists in function fromwebExcptypemanFilter in /goform/webExcptypemanFilter, where manipulation of the page argument causes a stack-based buffer overflow. This can be exploited remotely and, per sources, an explo...

CVE-2024-3877

CVE-2024-3877 affects Tenda F1202 firmware 1.2.0.20(408). The vulnerable component is the function fromqossetting in /goform/fromqossetting, where manipulating the qos argument triggers a stack-based buffer overflow. This enables a remote attacker to potentially execute arbitrary code with high i...

CVE-2024-3877 Tenda F1202 fromqossetting stack-based overflow

A vulnerability classified as critical was found in Tenda F1202 1.2.0.20408. Affected by this vulnerability is the function fromqossetting of the file /goform/fromqossetting. The manipulation of the argument qos leads to stack-based buffer overflow. The attack can be launched remotely. The exploi...

CVE-2024-3876 Tenda F1202 VirtualSer fromVirtualSer stack-based overflow

A vulnerability classified as critical has been found in Tenda F1202 1.2.0.20408. Affected is the function fromVirtualSer of the file /goform/VirtualSer. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been...

Rapid7 Insight Platform Achieves Level 2 TX-Ramp Authorization

Authored by Damon Cabanillas Rapid7's Insight Platform has officially achieved Level 2 Texas Risk and Authorization Management Program TX-RAMP authorization. This milestone marks a significant step forward in providing our customers peace-of-mind as well as the best end-to-end cloud security...

CVE-2024-3874 Tenda W20E SetRemoteWebManage formSetRemoteWebManage stack-based overflow

A vulnerability was found in Tenda W20E 15.11.0.6. It has been declared as critical. This vulnerability affects the function formSetRemoteWebManage of the file /goform/SetRemoteWebManage. The manipulation of the argument remoteIP leads to stack-based buffer overflow. The attack can be initiated...

shim: RCE in http boot support may lead to Secure Boot bypass

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete...

GHSA-QH6X-J82H-VPF9 gradio Server-Side Request Forgery vulnerability

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...