deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-29239
Published: 2024-03-28
Description: Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://www.synology.com/en-global/security/advisory/Synology_SA_24_04; https://www.synology.com/en-global/security/advisory/Synology_SA_24_04
CVE: CVE-2024-29240
Published: 2024-03-28
Description: Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to conduct limited denial-of-service attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.synology.com/en-global/security/advisory/Synology_SA_24_04; https://www.synology.com/en-global/security/advisory/Synology_SA_24_04
CVE: CVE-2024-29241
Published: 2024-03-28
Description: Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain non-sensitive information, write sensitive configurations in DSM, and reboot or shutdown NAS via unspecified vectors.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-862
References: https://www.synology.com/en-global/security/advisory/Synology_SA_24_04; https://www.synology.com/en-global/security/advisory/Synology_SA_24_04
CVE: CVE-2024-2890
Published: 2024-03-28
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Tumult Inc. Tumult Hype Animations.This issue affects Tumult Hype Animations: from n/a through 1.9.12.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/tumult-hype-animations/wordpress-tumult-hype-animations-plugin-1-9-12-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tumult-hype-animations/wordpress-tumult-hype-animations-plugin-1-9-12-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-52628
Published: 2024-03-28
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nftables: exthdr: fix 4-byte stack OOB write

If priv->len is a multiple of 4, then dst[len / 4] can write past
the destination array which leads to stack corruption.

This construct is necessary to clean the remainder of the register
in case ->len is NOT a multiple of the register size, so make it
conditional just like nft_payload.c does.

The bug was added in 4.1 cycle and then copied/inherited when
tcp/sctp and ip option support was added.

Bug reported by Zero Day Initiative project (ZDI-CAN-21950,
ZDI-CAN-21951, ZDI-CAN-21961).
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/1ad7b189cc[PII_REDACTED]e8595ffcbe7873b71082; https://git.kernel.org/stable/c/28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a; https://git.kernel.org/stable/c/a7d86a77c33ba1c357a[PII_REDACTED]cc1507f0698
CVE: CVE-2023-6371
Published: 2024-03-28
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. A wiki page with a crafted payload may lead to a Stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/433021; https://hackerone.com/reports/2257080; https://gitlab.com/gitlab-org/gitlab/-/issues/433021
CVE: CVE-2024-2818
Published: 2024-03-28
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. It was possible for an attacker to cause a denial of service using malicious crafted description parameter for labels.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/434803; https://gitlab.com/gitlab-org/gitlab/-/issues/434803
CVE: CVE-2024-30421
Published: 2024-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.7.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/events-manager/wordpress-events-manager-plugin-6-4-7-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/events-manager/wordpress-events-manager-plugin-6-4-7-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-30422
Published: 2024-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through <= 1.13.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/addon-elements-for-elementor-page-builder/vulnerability/wordpress-elementor-addon-elements-plugin-1-13-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/addon-elements-for-elementor-page-builder/wordpress-elementor-addon-elements-plugin-1-13-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-30595
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the addWifiMacFilter function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/addWifiMacFilter_deviceId.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/addWifiMacFilter_deviceId.md
CVE: CVE-2024-27775
Published: 2024-03-28
Description: 
SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash


CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-29896
Published: 2024-03-28
Description: Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566d; https://github.com/KindSpells/astro-shield/security/advisories/GHSA-w387-5qqw-7g8m; https://github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566d
CVE: CVE-2024-30593
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability located in the deviceName parameter of the formSetDeviceName function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formSetDeviceName_devName.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formSetDeviceName_devName.md
CVE: CVE-2024-30594
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/addWifiMacFilter_deviceMac.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/addWifiMacFilter_deviceMac.md
CVE: CVE-2024-30596
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the formSetDeviceName function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formSetDeviceName_deviceId.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formSetDeviceName_deviceId.md
CVE: CVE-2023-6437
Published: 2024-03-28
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u allows authenticated OS Command Injection.This issue affects TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3 : through 20240328. Also  the vulnerability continues in the TP-Link VX220-G2u and TP-Link VN020-G2u models due to the products not being produced and supported.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.usom.gov.tr/bildirim/tr-24-0244; https://www.usom.gov.tr/bildirim/tr-24-0244
CVE: CVE-2024-28109
Published: 2024-03-28
Description: veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-91
References: https://github.com/veraPDF/veraPDF-library/commit/614ffa477a2cf0819e4b0df1ab133610e0da25fb; https://github.com/veraPDF/veraPDF-library/commit/9386ecbe1a1d1fb9e886d19df28851ed07890d9f; https://github.com/veraPDF/veraPDF-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe
CVE: CVE-2024-29200
Published: 2024-03-28
Description: Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the `view_other_timesheet` permission to true, on the frontend, users can only see timesheet entries for teams they are a part of. When requesting all timesheets from the API, however, all timesheet entries are returned, regardless of whether the user shares team permissions or not. This vulnerability is fixed in 2.13.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1220
References: https://github.com/kimai/kimai/security/advisories/GHSA-cj3c-5xpm-cx94; https://github.com/kimai/kimai/security/advisories/GHSA-cj3c-5xpm-cx94
CVE: CVE-2024-29882
Published: 2024-03-28
Description: SRS is a simple, high-efficiency, real-time video server. SRS's `/api/v1/vhosts/vid-<id>?callback=<payload>` endpoint didn't filter the callback function name which led to injecting malicious javascript payloads and executing XSS ( Cross-Site Scripting). This vulnerability is fixed in 5.0.210 and 6.0.121.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://github.com/ossrs/srs/commit/244ce7bc013a0b805274a65132a2980680ba6b9d; https://github.com/ossrs/srs/security/advisories/GHSA-gv9r-qcjc-5hj7; https://github.com/ossrs/srs/commit/244ce7bc013a0b805274a65132a2980680ba6b9d
CVE: CVE-2024-29897
Published: 2024-03-28
Description: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) on any wiki in the farm to access suppressed wiki requests by going to the request's entry on Special:RequestWikiQueue on the wiki where they have these rights. The same vulnerability was present briefly on the REST API before being quickly corrected in commit `6bc0685`. To our knowledge, the vulnerable commits of the REST API are not running in production anywhere. This vulnerability is fixed in 23415c17ffb4832667c06abcf1eadadefd4c8937.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/miraheze/CreateWiki/security/advisories/GHSA-4rcf-3cj2-46mq; https://github.com/miraheze/mw-config/commit/fb3e68bcef459e9cf2a415241b28042a6c9727e8; https://issue-tracker.miraheze.org/F3093343
CVE: CVE-2024-29898
Published: 2024-03-28
Description: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed suppressed wiki requests to private wikis that added Special:RequestWikiQueue to the read whitelist to users without the `(read)` permission. This vulnerability is fixed in 8f8442ed5299510ea3e58416004b9334134c149c.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/miraheze/CreateWiki/commit/8f8442ed5299510ea3e58416004b9334134c149c; https://github.com/miraheze/CreateWiki/security/advisories/GHSA-4rcf-3cj2-46mq; https://github.com/miraheze/CreateWiki/security/advisories/GHSA-5rcv-cf88-gv8v
CVE: CVE-2024-30583
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the mitInterface parameter of the fromAddressNat function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/fromAddressNat_mitInterface.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/fromAddressNat_mitInterface.md
CVE: CVE-2024-30584
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWifiBasicSet_security.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWifiBasicSet_security.md
CVE: CVE-2024-30585
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/saveParentControlInfo_deviceId.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/saveParentControlInfo_deviceId.md
CVE: CVE-2024-30586
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWifiBasicSet_security_5g.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWifiBasicSet_security_5g.md
CVE: CVE-2024-30587
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/saveParentControlInfo_urls.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/saveParentControlInfo_urls.md
CVE: CVE-2024-30588
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the schedStartTime parameter of the setSchedWifi function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/setSchedWifi_start.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/setSchedWifi_start.md
CVE: CVE-2024-30589
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability in the entrys parameter of the fromAddressNat function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/fromAddressNat_entrys.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/fromAddressNat_entrys.md
CVE: CVE-2024-30590
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/setSchedWifi_end.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/setSchedWifi_end.md
CVE: CVE-2024-30591
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the time parameter of the saveParentControlInfo function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/saveParentControlInfo_time.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/saveParentControlInfo_time.md
CVE: CVE-2024-30592
Published: 2024-03-28
Description: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the page parameter of the fromAddressNat function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/fromAddressNat_page.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/fromAddressNat_page.md
CVE: CVE-2024-30606
Published: 2024-03-28
Description: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the page parameter of the fromDhcpListClient function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/fromDhcpListClient_page.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/fromDhcpListClient_page.md
CVE: CVE-2024-30607
Published: 2024-03-28
Description: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/saveParentControlInfo_deviceId.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/saveParentControlInfo_deviceId.md
CVE: CVE-2023-45705
Published: 2024-03-28
Description: An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.

CVSS Score: 3.5 (LOW)
CWE: CWE-918, CWE-918
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972
CVE: CVE-2023-45706
Published: 2024-03-28
Description: An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration.

CVSS Score: 2.0 (LOW)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972
CVE: CVE-2023-45715
Published: 2024-03-28
Description: The console may experience a service interruption when processing file names with invalid characters.

CVSS Score: 3.5 (LOW)
CWE: CWE-436
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972
CVE: CVE-2024-0259
Published: 2024-03-28
Description: Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges, allowing a low-privileged user to gain elevated privileges.


CVSS Score: 7.3 (HIGH)
CWE: CWE-276, CWE-276
References: https://hstechdocs.helpsystems.com/releasenotes/Content/_ProductPages/Robot/RobotScheduleEnterprise.htm; https://www.fortra.com/security/advisory/fi-2024-005; https://hstechdocs.helpsystems.com/releasenotes/Content/_ProductPages/Robot/RobotScheduleEnterprise.htm
CVE: CVE-2024-30597
Published: 2024-03-28
Description: Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formWifiBasicSet_security.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formWifiBasicSet_security.md
CVE: CVE-2024-30598
Published: 2024-03-28
Description: Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formWifiBasicSet_security_5g.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formWifiBasicSet_security_5g.md
CVE: CVE-2024-30599
Published: 2024-03-28
Description: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/addWifiMacFilter_deviceMac.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/addWifiMacFilter_deviceMac.md
CVE: CVE-2024-30600
Published: 2024-03-28
Description: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/setSchedWifi_end.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/setSchedWifi_end.md
CVE: CVE-2024-30601
Published: 2024-03-28
Description: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the time parameter of the saveParentControlInfo function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/saveParentControlInfo_time.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/saveParentControlInfo_time.md
CVE: CVE-2024-30602
Published: 2024-03-28
Description: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the schedStartTime parameter of the setSchedWifi function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/setSchedWifi_start.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/setSchedWifi_start.md
CVE: CVE-2024-30603
Published: 2024-03-28
Description: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/saveParentControlInfo_urls.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/saveParentControlInfo_urls.md
CVE: CVE-2024-30604
Published: 2024-03-28
Description: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the list1 parameter of the fromDhcpListClient function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/fromDhcpListClient_list1.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/fromDhcpListClient_list1.md
CVE: CVE-2024-30612
Published: 2024-03-28
Description: Tenda AC10U v15.03.06.48 has a stack overflow vulnerability in the deviceId, limitSpeed, limitSpeedUp parameter from formSetClientState function.
CVSS Score: 8.1 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.48/more/formSetClientState.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.48/more/formSetClientState.md
CVE: CVE-2024-31134
Published: 2024-03-28
Description: In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-31135
Published: 2024-03-28
Description: In JetBrains TeamCity before 2024.03 open redirect was possible on the login page
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/