Tenda FH1202 安全漏洞

Tenda FH1202 is a dual-band wireless router from Tenda that supports 2.4GHz and 5GHz bands with a total transmission rate of 1200Mbps. The Tenda FH1202 suffers from a buffer overflow vulnerability that originates from the adslPwd parameter of the formWanParameterSetting method failing to correctl...

PT-2024-23689 · Unknown · Pescms Team

Name of the Vulnerable Software and Affected Versions: PESCMS-TEAM version 2.3.6 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the domain input field under the...

CVE-2024-3877

A vulnerability classified as critical was found in Tenda F1202 1.2.0.20408. Affected by this vulnerability is the function fromqossetting of the file /goform/fromqossetting. The manipulation of the argument qos leads to stack-based buffer overflow. The attack can be launched remotely. The exploi...

HTMLy Version v2.9.6 - Stored XSS Vulnerability

Exploit Title: HTMLy Version v2.9.6 - Stored XSS Exploit Author: tmrswrr Vendor Homepage: https://www.htmly.com/ Version 3.10.8.21 Date : 04/08/2024 1 Login admin https://127.0.0.1/HTMLy/admin/config 2 General Setting Blog title " 3 After save it you will be see XSS alert...

CVE-2024-31309

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting proxy.config.http2.maxcontinuationframesperminute to limit the number of CONTINUATION frames...

HTMLy 2.9.6 Cross Site Scripting

Exploit Title: HTMLy Version : 2.9.6 - Stored XSS Exploit Author: tmrswrr Vendor Homepage: https://www.htmly.com/ Version 3.10.8.21 Date : 04/08/2024 1 Login admin https://127.0.0.1/HTMLy/admin/config 2 General Setting Blog title " 3 After save it you will be see xss alert...

WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Setting Deletion vulnerability

Unauthenticated Arbitrary WordPress Setting Deletion vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Bricksforge versions = 2.0.17...

CVE-2024-24506

Cross Site Scripting XSS vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrary code via the Administrator email address parameter in the General Setting function...

CVE-2024-24506

LimeSurvey Community Edition 5.3.32+220817 contains a Cross-Site Scripting (XSS) vulnerability in the General Setting function via the Administrator email address parameter. Exploitation can allow remote execution of scripts in a victim’s browser, potentially enabling session/cookie theft or cred...

CVE-2024-24506

Cross Site Scripting XSS vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrary code via the Administrator email address parameter in the General Setting function...

CVE-2024-3142 Clavister E10/E80 Setting cross-site request forgery

A vulnerability was found in Clavister E10 and E80 up to 14.00.10 and classified as problematic. This issue affects some unknown processing of the component Setting Handler. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed ...

The vulnerability of the Setting Handler component in the KeePassXC password manager allows attackers to circumvent existing security restrictions.

The vulnerability of the Setting Handler component in the KeePassXC password manager is related to the bypassing of security features. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions...

PT-2024-24060 · Clavister · Clavister E80 +1

Name of the Vulnerable Software and Affected Versions: Clavister E10 and E80 versions up to 14.00.10 Description: A vulnerability was found in the Setting Handler component, leading to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public a...

BIT-DISCOURSE-2024-27085 Denial of service through invites in Discourse

Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...

CVE-2023-6154

A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a third-party library upon execution. This...

CVE-2023-6154 Local privilege escalation in Bitdefender Total Security (VA-11168)

A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a third-party library upon execution. This...

CVE-2023-6154 Local privilege escalation in Bitdefender Total Security (VA-11168)

A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a third-party library upon execution. This...

CVE-2023-6154

CVE-2023-6154 affects Bitdefender Total Security, Internet Security, Antivirus Plus, and Antivirus Free (all reported as 27.0.25.114). Root cause: a configuration setting issue in seccenter.exe that allows an attacker to change the product’s expected behavior and potentially load a third‑party li...

Tenda FH1203 fromNatStaticSetting Method Stack Buffer Overflow Vulnerability

Tenda FH1203 is a dual-band wireless router from China's Tenda, mainly used for home network coverage and enhancement. The Tenda FH1203 suffers from a stack buffer overflow vulnerability that stems from the page parameter of the fromNatStaticSetting method of the /goform/NatStaticSetting file...

PT-2024-9410 · Synology · Synology Surveillance Station

Name of the Vulnerable Software and Affected Versions: Synology Surveillance Station versions prior to 9.2.0-11289 and 9.2.0-9289 Description: The issue is related to an incorrect authorization vulnerability in the Alert.Setting webapi component. This allows remote authenticated users to perform...