Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,837 results · page 69 of 137
Apr 27, 2024A vulnerability was found in Tenda i21 1.0.0.14(4656) and classified as critical.CVE-2024-4248 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda i21 1.0.0.14(4656) and classified as critical. This issue affects the function formQosManage_user. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-262139. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2024A vulnerability has been found in Tenda i21 1.0.0.14(4656) and classified as critical.CVE-2024-4247 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability has been found in Tenda i21 1.0.0.14(4656) and classified as critical. This vulnerability affects the function formQosManage_auto. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack can be initiated remotely. VDB-262138 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2024A vulnerability, which was classified as critical, was found in Tenda i21 1.0.0.14(4656).CVE-2024-4246 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda i21 1.0.0.14(4656). This affects the function formQosManageDouble_auto. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The identifier VDB-262137 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2024A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656).CVE-2024-4245 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656). Affected by this issue is the function formQosManageDouble_user. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be launched remotely. The identifier of this vulnerability is VDB-262136. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A vulnerability classified as critical was found in Tenda W9 1.0.0.7(4456).CVE-2024-4244 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda W9 1.0.0.7(4456). Affected by this vulnerability is the function fromDhcpSetSer of the file /goform/DhcpSetSer. The manipulation of the argument dhcpStartIp/dhcpEndIp/dhcpGw/dhcpMask/dhcpLeaseTime/dhcpDns1/dhcpDns2 leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-262135. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A vulnerability classified as critical has been found in Tenda W9 1.0.0.7(4456).CVE-2024-4243 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda W9 1.0.0.7(4456). Affected is the function formwrlSSIDset of the file /goform/wifiSSIDset. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-262134 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A vulnerability was found in Tenda AX1806 1.0.0.1 and classified as critical.CVE-2024-4239 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this issue is the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument rebootTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-262130 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AX1806
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A vulnerability has been found in Tenda AX1806 1.0.0.1 and classified as critical.CVE-2024-4238 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability has been found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this vulnerability is the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262129 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AX1806
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A vulnerability, which was classified as critical, was found in Tenda AX1806 1.0.0.1.CVE-2024-4237 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda AX1806 1.0.0.1. Affected is the function R7WebsSecurityHandler of the file /goform/execCommand. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262128. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AX1806
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A vulnerability, which was classified as critical, has been found in Tenda AX1803 1.0.0.1.CVE-2024-4236 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda AX1803 1.0.0.1. This issue affects the function formSetSysToolDDNS of the file /goform/SetDDNSCfg. The manipulation of the argument serverName/ddnsUser/ddnsPwd/ddnsDomain leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-262127. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AX1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link.CVE-2024-32764 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.9
A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users with the privilege level of some functionality via a network. We have already fixed the vulnerability in the following version: myQNAPcloud Link 2.4.51 and later
- Product
- myQNAPcloud Link
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024An issue discovered in Yealink VP59 Teams Editions with firmware version 91.15.0.118 allows a physically proximate attacker to gain control of an account via a CVE-2024-30939 · Other software · yealink · reported by MITREMedium 6.8
An issue discovered in Yealink VP59 Teams Editions with firmware version 91.15.0.118 allows a physically proximate attacker to gain control of an account via a flaw in the factory reset procedure.
- Product
- yealink_vp59_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations.CVE-2024-25624 · Other software · dfir-iris · reported by GitHubMedium 6.8
Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Due to an improper setup of Jinja2 environment, reports generation in `iris-web` is prone to a Server Side Template Injection (SSTI). Successful exploitation of the vulnerability can lead to an arbitrary Remote Code Execution. An authenticated administrator has to upload a crafted report template containing the payload. Upon generation of a report based on the weaponized report, any user can trigger the vulnerability. The vulnerability is patched in IRIS v2.4.6. No workaround is available. It is recommended to update as soon as possible. Until patching, review the report templates and keep the administrative privileges that include the upload of report templates limited to dedicated users.
- Product
- iris-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024A vulnerability classified as critical has been found in Tenda W30E 1.0/1.0.1.25.CVE-2024-4171 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda W30E 1.0/1.0.1.25. Affected is the function fromWizardHandle of the file /goform/WizardHandle. The manipulation of the argument PPW leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261990 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W30E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024A vulnerability was found in Tenda 4G300 1.01.42 and classified as critical.CVE-2024-4167 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda 4G300 1.01.42 and classified as critical. Affected by this issue is the function sub_422AA4. The manipulation of the argument year/month/day/hour/minute/second leads to stack-based buffer overflow. The attack may be launched remotely. VDB-261986 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 4G300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024A vulnerability has been found in Tenda 4G300 1.01.42 and classified as critical.CVE-2024-4166 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability has been found in Tenda 4G300 1.01.42 and classified as critical. Affected by this vulnerability is the function sub_41E858. The manipulation of the argument GO/page leads to stack-based buffer overflow. The attack can be launched remotely. The identifier VDB-261985 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 4G300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024A vulnerability, which was classified as critical, was found in Tenda G3 15.11.0.17(9502).CVE-2024-4165 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda G3 15.11.0.17(9502). Affected is the function modifyDhcpRule of the file /goform/modifyDhcpRule. The manipulation of the argument bindDhcpIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261984. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- G3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024A vulnerability, which was classified as critical, has been found in Tenda G3 15.11.0.17(9502).CVE-2024-4164 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda G3 15.11.0.17(9502). This issue affects the function formModifyPppAuthWhiteMac of the file /goform/ModifyPppAuthWhiteMac. The manipulation of the argument pppoeServerWhiteMacIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261983. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- G3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical.CVE-2024-4126 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical. This issue affects the function formSetSysTime of the file /goform/SetSysTimeCfg. The manipulation of the argument manualTime leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261869 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability has been found in Tenda W15E 15.11.0.14 and classified as critical.CVE-2024-4125 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability has been found in Tenda W15E 15.11.0.14 and classified as critical. This vulnerability affects the function formSetStaticRoute of the file /goform/setStaticRoute. The manipulation of the argument staticRouteIndex leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261868. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14.CVE-2024-4124 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14. This affects the function formSetRemoteWebManage of the file /goform/SetRemoteWebManage. The manipulation of the argument remoteIP leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261867. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability, which was classified as critical, has been found in Tenda W15E 15.11.0.14.CVE-2024-4123 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda W15E 15.11.0.14. Affected by this issue is the function formSetPortMapping of the file /goform/SetPortMapping. The manipulation of the argument portMappingServer/portMappingProtocol/portMappingWan/porMappingtInternal/portMappingExternal leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-261866 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability classified as critical was found in Tenda W15E 15.11.0.14.CVE-2024-4122 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda W15E 15.11.0.14. Affected by this vulnerability is the function formSetDebugCfg of the file /goform/setDebugCfg. The manipulation of the argument enable/level/module leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261865 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability classified as critical has been found in Tenda W15E 15.11.0.14.CVE-2024-4121 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda W15E 15.11.0.14. Affected is the function formQOSRuleDel. The manipulation of the argument qosIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-261864. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical.CVE-2024-4117 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical. Affected by this issue is the function formDelPortMapping of the file /goform/DelPortMapping. The manipulation of the argument portMappingIndex leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261860. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability has been found in Tenda W15E 15.11.0.14 and classified as critical.CVE-2024-4116 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability has been found in Tenda W15E 15.11.0.14 and classified as critical. Affected by this vulnerability is the function formDelDhcpRule of the file /goform/DelDhcpRule. The manipulation of the argument delDhcpIndex leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261859. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14.CVE-2024-4115 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14. Affected is the function formAddDnsForward of the file /goform/AddDnsForward. The manipulation of the argument DnsForwardRule leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261858 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability, which was classified as critical, has been found in Tenda TX9 22.03.02.10.CVE-2024-4114 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda TX9 22.03.02.10. This issue affects the function sub_42C014 of the file /goform/PowerSaveSet. The manipulation of the argument time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261857 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- TX9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability classified as critical was found in Tenda TX9 22.03.02.10.CVE-2024-4113 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda TX9 22.03.02.10. This vulnerability affects the function sub_42D4DC of the file /goform/SetSysTimeCfg. The manipulation of the argument time leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261856. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- TX9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability classified as critical has been found in Tenda TX9 22.03.02.10.CVE-2024-4112 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda TX9 22.03.02.10. This affects the function sub_42CB94 of the file /goform/SetVirtualServerCfg. The manipulation of the argument list leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261855. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- TX9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2024A vulnerability classified as critical has been found in Tenda AC8 16.03.34.09.CVE-2024-4066 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda AC8 16.03.34.09. Affected is the function fromAdvSetMacMtuWan of the file /goform/AdvSetMacMtuWan. The manipulation of the argument wanMTU/wanSpeed/cloneType/mac/serviceName/serverName leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261792. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2024QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval.CVE-2023-48183 · Other software · quickjs_project · reported by MITREHigh 7.5
QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval.
- Product
- quickjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2024An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to erase a critical sector of the flash memory, causing the machine to lose CVE-2024-22807 · Other software · tormach · reported by MITREMedium 6.5
An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to erase a critical sector of the flash memory, causing the machine to lose network connectivity and suffer from firmware corruption.
- Product
- pilotpath_controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 20, 2024A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical.CVE-2024-4020 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical. This issue affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument entrys leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- FH1206
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalm-vertebra-fe9.notion.sitevuldb.com
Apr 20, 2024A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411.CVE-2024-4019 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411. Affected is an unknown function of the file /importhtml.php. The manipulation of the argument sql leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261666 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S80 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2024 In Brocade SANnav server before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are identical in the VM every time SANnav is installed.CVE-2024-29960 · Other software · Brocade · reported by sirt@brocade.comMedium 6.8
In Brocade SANnav server before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are identical in the VM every time SANnav is installed. Any Brocade SAnnav VM based on the official OVA images is vulnerable to MITM over SSH. An attacker can decrypt and compromise the SSH traffic to the SANnav.
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
Apr 18, 2024The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to thCVE-2024-21872 · Other software · Electrolink · reported by ics-cert@hq.dhs.govHigh 8.7
The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter.
- Product
- Compact DAB Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A vulnerability, which was classified as critical, has been found in Tenda AC500 2.0.1.9(1307).CVE-2024-3910 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda AC500 2.0.1.9(1307). Affected by this issue is the function fromDhcpListClient of the file /goform/DhcpListClient. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-261146 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A vulnerability classified as critical was found in Tenda AC500 2.0.1.9(1307).CVE-2024-3909 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda AC500 2.0.1.9(1307). Affected by this vulnerability is the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261145 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A vulnerability classified as critical has been found in Tenda AC500 2.0.1.9(1307).CVE-2024-3908 · Network & remote access · Tenda · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Tenda AC500 2.0.1.9(1307). Affected is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261144. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2024-21086 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024A vulnerability was found in Tenda W30E 1.0.1.25(633) and classified as critical.CVE-2024-3881 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda W30E 1.0.1.25(633) and classified as critical. This issue affects the function frmL7PlotForm of the file /goform/frmL7ProtForm. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260915. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W30E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024A vulnerability has been found in Tenda W30E 1.0.1.25(633) and classified as critical.CVE-2024-3880 · Network & remote access · Tenda · reported by VulDBMedium 6.3
A vulnerability has been found in Tenda W30E 1.0.1.25(633) and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-260914 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W30E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024A vulnerability, which was classified as critical, was found in Tenda W30E 1.0.1.25(633).CVE-2024-3879 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda W30E 1.0.1.25(633). This affects the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260913 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W30E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024A vulnerability, which was classified as critical, has been found in Tenda F1202 1.2.0.20(408).CVE-2024-3878 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda F1202 1.2.0.20(408). Affected by this issue is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260912. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024A vulnerability classified as critical was found in Tenda F1202 1.2.0.20(408).CVE-2024-3877 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda F1202 1.2.0.20(408). Affected by this vulnerability is the function fromqossetting of the file /goform/fromqossetting. The manipulation of the argument qos leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260911. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024A vulnerability classified as critical has been found in Tenda F1202 1.2.0.20(408).CVE-2024-3876 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromVirtualSer of the file /goform/VirtualSer. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-260910 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024In huge memory get unmapped area check, code can never be reached because of a logical contradiction.CVE-2024-32634 · Other software · ASR · reported by 68630edc-a58c-4cbd-9b01-0e130455c8aeMedium 6.1
In huge memory get unmapped area check, code can never be reached because of a logical contradiction.
- Product
- Falcon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasrmicro.comasrmicro.com
Apr 15, 2024A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function.CVE-2024-3271 · Other software · run-llama · reported by security@huntr.devCritical 9.8
A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by crafting input that does not contain an underscore but still results in the execution of OS commands. The vulnerability allows for remote code execution (RCE) on the server hosting the application.
- Product
- run-llama/llama_index
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint.CVE-2024-2083 · Other software · zenml-io · reported by security@huntr.devCritical 9.9
A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The vulnerability arises due to the lack of validation for directory traversal patterns, allowing attackers to access files outside of the restricted directory.
- Product
- zenml-io/zenml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.