CVE-2024-46658

Syrotech SY-GOPON-8OLT-L3 v1.6.0240629 was discovered to contain an authenticated command injection vulnerability...

CVE-2024-46658

CVE-2024-46658 concerns Syrotech SY-GOPON-8OLT-L3 hardware (firmware v1.6.0_240629). The authenticated command-injection vulnerability is described as requiring LOW privileges with an adjacent attack vector and no user interaction. The CVSSv3.1 base score is 8.0 (HIGH), with impacts to confidenti...

CVE-2024-41692

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the root shell on the vulnerable system. Successful exploitation of this...

CVE-2024-41686

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could exploit this by creating password that do not adhere to the defined security standards/policy on the vulnerable system. Successful exploitation of this...

CVE-2024-41692 Incorrect Access Control Vulnerability

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the root shell on the vulnerable system. Successful exploitation of this...

CVE-2024-41692

The CVE-2024-41692 issue affects SyroTech SY-GPON-1110-WDONT Router. It stems from root terminal access on the serial interface without proper access control, enabling an attacker with physical access to reach the root shell and potentially run arbitrary commands with root privileges. The linked ...

CVE-2024-41691

CVE-2024-41691 affects SyroTech SY-GPON-1110-WDONT router. Affected component: firmware SquashFS-root stores FTP credentials in plaintext, enabling an attacker with physical access to extract firmware, reverse‑engineer data, and access the FTP server credentials. Impact: unauthorized FTP access a...

CVE-2024-41691 Insecure Storage of Sensitive Information Vulnerability

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root filesystem associated with the router's firmware. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary...

CVE-2024-41689 Hard-coded Credentials Vulnerability

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext WP...

CVE-2024-41688 Cleartext Storage of Sensitive Information Vulnerability

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the...

CVE-2024-41684 Cookie Without Secure Flag Set Vulnerability

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system...

PT-2024-29506 · Syrotech · Syrotech Sy-Gpon-1110-Wdont Router

Name of the Vulnerable Software and Affected Versions: SyroTech SY-GPON-1110-WDONT Router affected versions not specified Description: The issue arises from the improper implementation of password policies. A local attacker could exploit this by creating passwords that do not adhere to the define...

CVE-2024-5378

A vulnerability was found in SourceCodester School Intramurals Student Attendance Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /managesy.php. The manipulation of the argument id leads to sql injection. The attack can be initiated...

School Intramurals Student Attendance Management System SQL注入漏洞

School Intramurals Student Attendance Management System is an on-campus student attendance management system by the individual developer oretnom23. A SQL injection vulnerability exists in SourceCodester School Intramurals Student Attendance Management System version 1.0, which originates from...

The vulnerability of the MODULYS GP (MOD3GP-SY-120K) module-based power supply management web application allows a attacker to perform arbitrary actions.

The vulnerability of the MODULYS GP MOD3GP-SY-120K web-based management application relates to its dependence on cookie files without any checks for their validity and integrity. Exploiting this vulnerability could allow an attacker to perform arbitrary actions remotely...

CVE-2023-38582

Persistent cross-site scripting XSS in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAILRCV. When a legitimate user attempts to access to the vulnerable page of the web application, the X...

Cross site scripting

UNSUPPPORTED WHEN ASSIGNED Persistent cross-site scripting XSS in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAILRCV. When a legitimate user attempts to access to the vulnerable page of...

CVE-2023-38255 Socomec MOD3GP-SY-120K Cross-site Scripting

A potential attacker with or without cookie theft access to the device would be able to include malicious code XSS when uploading new device configuration that could affect the intended function of the device...

CVE-2023-38582

MOD3GP-SY-120K (MODULYS GP) web firmware v01.12.10 is affected by a persistent cross-site scripting (XSS) flaw in the MAIL_RCV field that allows an authenticated remote attacker to inject arbitrary JavaScript, executed when a user loads the vulnerable page. Affected product is the MOD3GP-SY-120K ...

CVE-2023-38582 Socomec MOD3GP-SY-120K Cross-site Scripting

Persistent cross-site scripting XSS in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAILRCV. When a legitimate user attempts to access to the vulnerable page of the web application, the X...