CVE-2024-2902 Tenda AC7 WifiGuestSet fromSetWifiGusetBasic stack-based overflow

A vulnerability was found in Tenda AC7 15.03.06.44 and classified as critical. This issue affects the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet. The manipulation of the argument shareSpeed leads to stack-based buffer overflow. The attack may be initiated remotely. The exploi...

CVE-2024-2901

CVE-2024-2901 affects Tenda AC7 (15.03.06.44) in the /goform/openSchedWifi endpoint via the setSchedWifi function. The issue is a stack-based buffer overflow caused by manipulating the schedEndTime parameter, enabling remote in‑the‑wild exploitation as disclosed. No official fix version is provid...

CVE-2024-2898

A vulnerability classified as critical was found in Tenda AC7 15.03.06.44. Affected by this vulnerability is the function fromSetRouteStatic of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. The attack can be launched remotely. The...

CVE-2024-2899

CVE-2024-2899 affects Tenda AC7 (v15.03.06.44). The vulnerability resides in the fromSetWirelessRepeat function within /goform/WifiExtraSet, where manipulation of the wpapsk_crypto parameter leads to a stack-based buffer overflow. A remote attacker could exploit this, and public disclosures exist...

CVE-2024-2896

A vulnerability was found in Tenda AC7 15.03.06.44. It has been rated as critical. This issue affects the function formWifiWpsStart of the file /goform/WifiWpsStart. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has...

CVE-2023-52624

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wake DMCUB before executing GPINT commands Why DMCUB can be in idle when we attempt to interface with the HW through the GPINT mailbox resulting in a system hang. How Add dcwakeandexecutegpint to wrap the wake,...

CVE-2024-2896

CVE-2024-2896 affects Tenda AC7 firmware 15.03.06.44, impacting the function formWifiWpsStart in /goform/WifiWpsStart. The issue is a stack-based buffer overflow caused by manipulation of the index argument, allowing potential remote exploitation. Public exploit details exist, and advisories note...

CVE-2023-52624 drm/amd/display: Wake DMCUB before executing GPINT commands

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wake DMCUB before executing GPINT commands Why DMCUB can be in idle when we attempt to interface with the HW through the GPINT mailbox resulting in a system hang. How Add dcwakeandexecutegpint to wrap the wake,...

CVE-2024-29832

CVE-2024-29832 affects the Photo Gallery WordPress plugin. The vulnerability is a reflected XSS in the current_url parameter of the admin-ajax.php GalleryBox AJAX call, where the current_url value is embedded into existing JavaScript in the response, allowing arbitrary JavaScript execution. Explo...

python-twisted: disordered HTTP pipeline response in twisted.web

Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, th...

User Enumeration

Liferay Portal is vulnerable to a User Enumeration. The vulnerability is due to differences in response times of requests, allowing remote attackers to determine the existence of an account in the application...

WordPress plugin PhotoGallery 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2023-48296 OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID

OroPlatform is a PHP Business Application Platform BAP. Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4...

CVE-2023-48296 OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID

OroPlatform is a PHP Business Application Platform BAP. Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4...

CVE-2023-48296

Summary: OroPlatform (PHP BAP) contains an information disclosure vulnerability in the JSON navigation response. If a storefront user’s ID matches a back-office user’s ID, the response leaks navigation history, as well as most viewed and favorite navigation items. Root cause: Insufficient access ...

CVE-2024-25175

An issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP response splitting attack...

CVE-2024-25175

An issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP response splitting attack...

CVE-2024-25175

Kickdler is affected by a Reflected XSS due to HTTP response splitting in versions prior to 1.107.0. The issue arises from improper handling of line breaks that allows an attacker to inject script via crafted input (e.g., kickidler_authentication_token). Impact is XSS with user interaction requir...

CVE-2024-25175

An issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP response splitting attack...

Wallos < 1.11.2 - File Upload RCE

Exploit Title: Wallos - File Upload RCE Authenticated Date: 2024-03-04 Exploit Author: [email protected] Vendor Homepage: https://github.com/ellite/Wallos Software Link: https://github.com/ellite/Wallos Version: -----------------------------29251442139...