Information disclosure

A vulnerability classified as problematic has been found in Totolink T8 4.1.5cu.83320220905. This affects the function getSysStatusCfg of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument ssid/key leads to information disclosure. It is possible to...

PT-2024-15663

Name of the Vulnerable Software and Affected Versions Totolink N350RT version 9.3.5u.6265 Description A critical vulnerability was found in the Setting Handler component, affecting unknown code of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls, and the attack ca...

CVE-2021-24151: Improper Neutralization of Special Elements used in an SQL Command

The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated admin+ blind SQL injection issue via an arbitrary parameter when making a request to save the settings...

CVE-2024-0570: Improper Access Control

A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6265. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. It is recommended t...

PT-2024-15662

Name of the Vulnerable Software and Affected Versions Totolink T8 version 4.1.5cu.833 20220905 Description A problematic vulnerability has been found in the Totolink T8, affecting the getSysStatusCfg function of the /cgi-bin/cstecgi.cgi file in the Setting Handler component. The manipulation of t...

CVE-2024-0569: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability classified as problematic has been found in Totolink T8 4.1.5cu.83320220905. This affects the function getSysStatusCfg of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument ssid/key leads to information disclosure. It is possible to...

EulerOS 2.0 SP8 : systemd (EulerOS-SA-2023-3162)

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the...

CVE-2024-0557

A vulnerability, which was classified as problematic, was found in DedeBIZ 6.3.0. This affects an unknown part of the component Website Copyright Setting. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public a...

CVE-2024-0557

A vulnerability, which was classified as problematic, was found in DedeBIZ 6.3.0. This affects an unknown part of the component Website Copyright Setting. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public a...

Cross site scripting

A vulnerability, which was classified as problematic, was found in DedeBIZ 6.3.0. This affects an unknown part of the component Website Copyright Setting. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public a...

CVE-2024-0557 DedeBIZ Website Copyright Setting cross site scripting

A vulnerability, which was classified as problematic, was found in DedeBIZ 6.3.0. This affects an unknown part of the component Website Copyright Setting. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public a...

CVE-2024-0557 DedeBIZ Website Copyright Setting cross site scripting

A vulnerability, which was classified as problematic, was found in DedeBIZ 6.3.0. This affects an unknown part of the component Website Copyright Setting. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public a...

DedeBIZ Cross-Site Scripting Vulnerability

DedeBIZ is a content management system from China Muyun Intelligent Technology DedeBIZ company. A cross-site scripting vulnerability exists in DedeBIZ version 6.3.0, which stems from an unknown section in the component Website Copyright Setting, leading to cross-site scripting...

CVE-2024-0557: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in DedeBIZ 6.3.0. This affects an unknown part of the component Website Copyright Setting. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public a...

PT-2024-15656 · Dedebiz · Dedebiz

Name of the Vulnerable Software and Affected Versions: DedeBIZ version 6.3.0 Description: A vulnerability was found in the Website Copyright Setting component, which can be exploited remotely. The manipulation leads to cross site scripting. The vendor was contacted about this disclosure but did n...

Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

Summary The Home Preference page exposes a small list of nginx settings such as Nginx Access Log Path and Nginx Error Log Path. However, the API also exposes testconfigcmd, reloadcmd and restartcmd. While the UI doesn't allow users to modify any of these settings, it is possible to do so by sendi...

PT-2024-14351 · Tenda · Tenda Ax1803

Name of the Vulnerable Software and Affected Versions: Tenda AX1803 version 1.0.0.1 Description: The issue is a stack overflow that occurs via the adv.iptv.stballvlans parameter in the setIptvInfo function. Recommendations: For Tenda AX1803 version 1.0.0.1, consider disabling the setIptvInfo...

savignano S/Notify Security Vulnerabilities

savignano S/Notify is savignano's most versatile email encryption solution for Jira, Confluence and Bitbucket. A security vulnerability exists in savignano S/Notify versions prior to 2.0.1 that originates from a configuration setting that can be modified via a cross-site request forgery CSRF...

WordPress Plugin Complianz Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-7035

A vulnerability was found in automad up to 1.10.9 and classified as problematic. Affected by this issue is some unknown functionality of the file packages\standard\templates\post.php of the component Setting Handler. The manipulation of the argument sitename leads to cross site scripting. The...