deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49203
Published: 2024-09-18
Description: Technitium 11.5.3 allows remote attackers to cause a denial of service (bandwidth amplification) because the DNSBomb manipulation causes accumulation of low-rate DNS queries such that there is a large-sized response in a burst of traffic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-406
References: https://gist.github.com/idealeer/89947ca07836fd0f7e9761198ca9a0f3.; https://technitium.com/dns/
CVE: CVE-2024-34026
Published: 2024-09-18
Description: A stack-based buffer overflow vulnerability exists in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC _v3 b4702061dc14d1024856f71b4543298d77007b88. A specially crafted EtherNet/IP request can lead to remote code execution. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2005; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2005
CVE: CVE-2024-35515
Published: 2024-09-18
Description: Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/piskvorky/sqlitedict/; https://wha13.github.io/2024/06/13/mfcve/
CVE: CVE-2024-36980
Published: 2024-09-18
Description: An out-of-bounds read vulnerability exists in the OpenPLC Runtime EtherNet/IP PCCC parser functionality of OpenPLC_v3 b4702061dc14d1024856f71b4543298d77007b88. A specially crafted network request can lead to denial of service. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.This is the first instance of the incorrect comparison.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2004; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2004
CVE: CVE-2024-36981
Published: 2024-09-18
Description: An out-of-bounds read vulnerability exists in the OpenPLC Runtime EtherNet/IP PCCC parser functionality of OpenPLC_v3 b4702061dc14d1024856f71b4543298d77007b88. A specially crafted network request can lead to denial of service. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.This is the final instance of the incorrect comparison.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2004; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2004
CVE: CVE-2024-39589
Published: 2024-09-18
Description: Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3 16bf8bac1a36d95b73e7b8722d0edb8b9c5bb56a. A specially crafted EtherNet/IP request can lead to denial of service. An attacker can send a series of EtherNet/IP requests to trigger these vulnerabilities.This instance of the vulnerability occurs within the `Protected_Logical_Read_Reply` function
CVSS Score: 7.5 (HIGH)
CWE: CWE-704, CWE-704
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2016; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2016
CVE: CVE-2024-39590
Published: 2024-09-18
Description: Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3 16bf8bac1a36d95b73e7b8722d0edb8b9c5bb56a. A specially crafted EtherNet/IP request can lead to denial of service. An attacker can send a series of EtherNet/IP requests to trigger these vulnerabilities.This instance of the vulnerability occurs within the `Protected_Logical_Write_Reply` function
CVSS Score: 7.5 (HIGH)
CWE: CWE-704, CWE-704
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2016; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2016
CVE: CVE-2024-44542
Published: 2024-09-18
Description: SQL Injection vulnerability in todesk v.1.1 allows a remote attacker to execute arbitrary code via the /todesk.com/news.html parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/alphandbelt/CVE-2024-44542/tree/main
CVE: CVE-2024-45858
Published: 2024-09-18
Description: An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing it to execute on the user's machine.
CVSS Score: 7.8 (HIGH)
CWE: CWE-95
References: https://hiddenlayer.com/sai-security-advisory/2024-09-guardrails/
CVE: CVE-2024-46550
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#bffdd8897d944a77834b865d9326a1d7
CVE: CVE-2024-46551
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#aabdeced2a5e407ba3b3c0d318af0a29
CVE: CVE-2024-46552
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstrt.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#53ad238cc1af41f7a32b29260f7274ec
CVE: CVE-2024-46553
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#1e21ab70186245aa8fb[PII_REDACTED]e2
CVE: CVE-2024-46554
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the profname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#ee86534f23b84f2cbfa9401ee1d9d179
CVE: CVE-2024-46555
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pb parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#e15d03bdd4b9441e8eb157fbd09969f4
CVE: CVE-2024-46556
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sInRCSecret0 parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#a26d36d8c8d042299348d8ec7a0260ca
CVE: CVE-2024-46557
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#8817e09b31b04ebebdaa5d6df1415df0
CVE: CVE-2024-46558
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the newProname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#43e2ae[PII_REDACTED]0ebec957696ceaa
CVE: CVE-2024-46559
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#acee48e159494c479aecc1bfa87f0d83
CVE: CVE-2024-46560
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pub_key parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#2a9a497ab8214aeb991df9b9714b3c25
CVE: CVE-2024-46561
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#48ac749c7e444d8398b414f9d1d48c40
CVE: CVE-2024-46564
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fextobj.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#4ebd20d478124581b01338b89622363a
CVE: CVE-2024-46565
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvName parameter at service.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#34ffb536a14f400680eec54e565b25f3
CVE: CVE-2024-46566
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAppName parameter at sslapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#fed8e44f6b1e44fa9432a8359c36906a
CVE: CVE-2024-46567
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iProfileIdx parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#c17358f2569248cea5c2b6c1bfe94306
CVE: CVE-2024-46568
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPeerId parameter at vpn.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#41a3e5586f424ceb858a5a66836a40cb
CVE: CVE-2024-46571
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#b325c78d0d4643b6a2e7703a811f1dd5
CVE: CVE-2024-46580
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the fid parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#230c640b5e354e20b5b529a510079eea
CVE: CVE-2024-46581
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#7c3324f08b21445fb00f1e8eaa26283f
CVE: CVE-2024-46582
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvAddr parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#20001f379c5641a1ab4f7ce459ce3db0
CVE: CVE-2024-46583
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the extRadSrv2 parameter at cgiapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#0f15f2bf2eb448c381255850e43cf96a
CVE: CVE-2024-46584
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the AControlIp1 parameter at acontrol.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#20fb6e1bcec049728e6319d9da46416d
CVE: CVE-2024-46585
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at usergrp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#8defec5c93be4cdfa5a1ea1078cbe7d2
CVE: CVE-2024-46586
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sCloudPass parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#3d4d22d30d164ef9b8fb1fe1024ada3a
CVE: CVE-2024-46588
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at wizfw.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#7be91fa3afab4c9c978f7f6c1cc4c847
CVE: CVE-2024-46589
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sIpv6AiccuUser parameter at inetipv6.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#e170f53316c740488da5d16f57be1b52
CVE: CVE-2024-46590
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#e0a960e24de649b3a67c21a63592d82f
CVE: CVE-2024-46591
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sDnsPro parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#336655c8396248a2b0fc7be9da0b64c9
CVE: CVE-2024-46592
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt_5g%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#1fe94a7181d24f5fbe464a5f9417d084
CVE: CVE-2024-46593
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#f85d41a6875a4853be9a3c457bc81a33
CVE: CVE-2024-46594
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveVPNProfile parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#33c5e76a919e4f04ae8a7bb039e37131
CVE: CVE-2024-46595
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveitem parameter at lan2lan.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#7f26d2119de54d5fbc25a8d3ebe2b16c
CVE: CVE-2024-46596
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAct parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#d049794ac4804e48968cb77589d5ec45
CVE: CVE-2024-46597
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#11467dddc16f460db85a5e8d3a6665fb
CVE: CVE-2024-46598
Published: 2024-09-18
Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#0875f261ad5c4e1ba59448d49a261a99
CVE: CVE-2024-5958
Published: 2024-09-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Panel allows Command Line Execution through SQL Injection.This issue affects Panel: before v2.3.24.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1497
CVE: CVE-2024-5959
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Stored XSS.This issue affects Panel: before v2.3.24.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-24-1497
CVE: CVE-2024-5960
Published: 2024-09-18
Description: Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials.This issue affects Panel: before v2.3.24.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-256
References: https://www.usom.gov.tr/bildirim/tr-24-1497
CVE: CVE-2024-6877
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Reflected XSS.This issue affects Panel: before v2.3.24.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-24-1497
CVE: CVE-2024-6878
Published: 2024-09-18
Description: Files or Directories Accessible to External Parties vulnerability in Eliz Software Panel allows Collect Data from Common Resource Locations.This issue affects Panel: before v2.3.24.
CWE: CWE-552
References: https://www.usom.gov.tr/bildirim/tr-24-1497
CVE: CVE-2022-25777
Published: 2024-09-18
Description: Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery (SSRF) vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/mautic/mautic/security/advisories/GHSA-mgv8-w49f-822w
CVE: CVE-2024-46086
Published: 2024-09-18
Description: FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/delete/123
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/PG2Stom/cms/tree/main/12/readme.md
CVE: CVE-2023-47105
Published: 2024-09-18
Description: exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without authentication.
CVSS Score: 8.6 (HIGH)
CWE: CWE-78
References: https://github.com/chaosblade-io/chaosblade/blob/0a07380c9899febb2b544132783b376b44226cca/exec/os/executor.go#L68; https://narrow-oatmeal-0c0.notion.site/ChaosBlade-Remote-Command-Execution-CVE-2023-47105-4f[PII_REDACTED]436caaec2bced6ff26d7