213680 matches found
Design/Logic Flaw
The configuration functionality in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands...
Command injection
Tenda W30E V16.01.0.124843 was discovered to contain a command injection vulnerability via the function setUmountUSBPartition...
Stack overflow
Tenda W30E V16.01.0.124843 was discovered to contain a stack overflow via the function localMsg...
Stack overflow
Tenda W30E V16.01.0.124843 was discovered to contain a stack overflow via the function formRebootMeshNode...
Stack overflow
Tenda W30E V16.01.0.124843 was discovered to contain a stack overflow via the function via the function setwanstatus...
Command injection
Tenda W30E V16.01.0.124843 was discovered to contain a command injection vulnerability via the function setFixTools...
Stack overflow
Tenda W30E V16.01.0.124843 was discovered to contain a stack overflow via the function formResetMeshNode...
Stack overflow
Tenda W30E V16.01.0.124843 was discovered to contain a stack overflow via the function formUpgradeMeshOnline...
Command injection
Tenda AX9 V22.03.01.46 was discovered to contain a SQL command injection vulnerability in the 'setDeviceInfo' feature through the 'mac' parameter at /goform/setModules...
Stack overflow
Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetVirtualServerCfg...
Code injection
Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and earlier. This allows an attacker with access to the Workspace application to access credentials when offline...
Command injection
Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName...
Stack overflow
Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetStaticRouteCfg...
Command injection
Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList...
Cross site scripting
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting XSS vulnerability via the imgstick parameter at selectimages.php...
Stack overflow
Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetNetControlList...
Stack overflow
Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'deviceList' parameter at /goform/setMacFilterCfg...
Command injection
Tenda AX9 V22.03.01.46 is vulnerable to command injection...
Code injection
Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc...
Cross site scripting
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting XSS vulnerability via the v parameter at selectimages.php...
Stack overflow
Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg...
Command injection
SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials...
Command injection
Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName...
Command injection
Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList...
Stack overflow
Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg...
Open redirect
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it's a duplicate of CVE-2023-39169...
Default credentials
The affected devices use publicly available default credentials with administrative privileges...
Code injection
In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data...
Open redirect
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it's a duplicate of CVE-2023-39167...
Cross site scripting
Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafted payload to the page parameter in the URL...
Code injection
The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic...
Stack overflow
Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg...
Open redirect
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site.This issue affects Integrate Google Drive – Browse, Upload, Download, Embed, Play,...
Open redirect
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Michael Uno miunosoft Responsive Column Widgets.This issue affects Responsive Column Widgets: from n/a through 1.2.7...
Open redirect
An issue was discovered in Dalmann OCPP.Core before 1.2.0 for OCPP Open Charge Point Protocol for electric vehicles. It does not validate the length of the chargePointVendor field in a BootNotification message, potentially leading to server instability and a denial of service when processing...
Open redirect
An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP Open Charge Point Protocol for electric vehicles. A StopTransaction message with any random transactionId terminates active transactions...
Open redirect
An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP Open Charge Point Protocol for electric vehicles. It permits multiple transactions with the same connectorId and idTag, contrary to the expected ConcurrentTx status. This could result in critical transaction management and billing...
Open redirect
An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP Open Charge Point Protocol for electric vehicles. The server processes mishandle StartTransaction messages containing additional, arbitrary properties, or duplicate properties. The last occurrence of a duplicate property is...
Denial of service
Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25...
Authentication flaw
Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15...
Open redirect
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4...
Open redirect
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages.This issue affects Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages: from n/a through 1.5.1.5...
Server side request forgery (ssrf)
Server-Side Request Forgery SSRF vulnerability in Softaculous Team SpeedyCache – Cache, Optimization, Performance.This issue affects SpeedyCache – Cache, Optimization, Performance: from n/a through 1.1.2...
Server side request forgery (ssrf)
Server-Side Request Forgery SSRF vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.24...
Server side request forgery (ssrf)
Server-Side Request Forgery SSRF vulnerability in Paytm Paytm Payment Gateway.This issue affects Paytm Payment Gateway: from n/a through 2.7.0...
Server side request forgery (ssrf)
Server-Side Request Forgery SSRF vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4...
Design/Logic Flaw
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this...
Code injection
TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security restrictions and execute arbitrary code...