EUVD-2021-21688

Malware in sbrugna...

CVE-2024-41253

goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component...

CVE-2021-35041

The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send a packet continuously. The packet is in an incorrect format and cannot be decoded by the node correctly. As a result, the node may consume the memory...

CVE-2024-56921

Open5GS vulnerability CVE-2024-56921 affects Open5GS v2.7.2. The issue is triggered by InitialUEMessage where a Registration request at a specific time leads to an AMF crash due to incorrect handling in gmm_state_exception() when processing Nausf_UEAuthentication_Authenticate. Potential impact is...

CVE-2024-44466

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub424CB4. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter iface...

CVE-2024-44466

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub424CB4. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter iface...

CVE-2024-44466

COMFAST CF-XR11 V2.7.2 is affected by a command-injection vulnerability in function sub_424CB4. An attacker can send POST requests to /usr/bin/webmgnt and inject commands via the iface parameter. The CVE-2024-44466 entries across multiple sources (NVD/Red Hat/CNNVD/etc.) corroborate a high-severi...

CVE-2024-41253

goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component...

CVE-2024-41253

The CVE-2024-41253 entry affects goframe v2.7.2, where the gclient component is configured to skip TLS certificate verification in the GHTTP client, enabling potential Man-in-the-Middle attacks. This is supported by Red Hat/Veracode/PT-2024-29331 entries and the NVD/NVD-derived descriptions. Impa...

CVE-2024-35232

The CVE-2024-35232 issue affects github.com/huandu/facebook, a Go package for Facebook Graph API usage. The root cause is that an access_token can be exposed in error messages during HTTP request failures, enabling potential information disclosure if logs or clients capture those messages. The vu...

CVE-2023-38866

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and displayname...

CVE-2023-38864

An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protaldeletepicname parameter in the sub41171C function at bin/webmgnt...

Command injection

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and displayname...

CVE-2023-38865

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr...

Command injection

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr...

CVE-2023-38866

CVE-2023-38866 affects COMFAST CF-XR11 v2.7.2. A command-injection vulnerability is exposed in the device’s /usr/bin/webmgnt endpoint, with the exploit vector leveraging the parameters interface and display_name via POST to inject commands, traced to function sub_415588. The CVSSv3.1 vector is NE...

CVE-2023-38865

CVE-2023-38865 affects COMFAST CF-XR11 v2.7.2. The vulnerability is a command-injection in function sub_4143F0, allowing an attacker to send POST requests to /usr/bin/webmgnt and inject commands via the timestr parameter. Connected sources confirm the affected product and vulnerable component; no...

CVE-2023-38865

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr...

CVE-2023-38866

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and displayname...

CVE-2023-38866

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and displayname...