deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-51520
Published: 2024-11-05
Description: Vulnerability of input parameters not being verified in the HDC module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2024/11/
CVE: CVE-2024-51521
Published: 2024-11-05
Description: Input parameter verification vulnerability in the background service module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2024/11/
CVE: CVE-2024-51522
Published: 2024-11-05
Description: Vulnerability of improper device information processing in the device management module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-199
References: https://consumer.huawei.com/en/support/bulletin/2024/11/
CVE: CVE-2024-51523
Published: 2024-11-05
Description: Information management vulnerability in the Gallery module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.1 (HIGH)
CWE: CWE-840
References: https://consumer.huawei.com/en/support/bulletin/2024/11/
CVE: CVE-2024-51524
Published: 2024-11-05
Description: Permission control vulnerability in the Wi-Fi module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2024/11/
CVE: CVE-2024-51525
Published: 2024-11-05
Description: Permission control vulnerability in the clipboard module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-285
References: https://consumer.huawei.com/en/support/bulletin/2024/11/
CVE: CVE-2024-51526
Published: 2024-11-05
Description: Permission control vulnerability in the hidebug module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 8.2 (HIGH)
CWE: CWE-347
References: https://consumer.huawei.com/en/support/bulletin/2024/11/
CVE: CVE-2024-51527
Published: 2024-11-05
Description: Permission control vulnerability in the Gallery app
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2024/11/
CVE: CVE-2024-51528
Published: 2024-11-05
Description: Vulnerability of improper log printing in the Super Home Screen module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://consumer.huawei.com/en/support/bulletin/2024/11/
CVE: CVE-2024-7429
Published: 2024-11-05
Description: The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_process_accounts_AJAX function in all versions up to, and including, 7.3.12. This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin's settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://plugins.trac.wordpress.org/browser/zotpress/trunk/lib/admin/admin.php#L40; https://plugins.trac.wordpress.org/changeset/3153348/zotpress/trunk/lib/admin/admin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/1f38676b-270f-4b0f-bc98-a14a26b86a50?source=cve
CVE: CVE-2024-9878
Published: 2024-11-05
Description: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/179357/WordPress-Photo-Gallery-1.8.26-Cross-Site-Scripting.html; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3180567%40photo-gallery%2Ftrunk&old=3171538%40photo-gallery%2Ftrunk&sfp_email=&sfph_mail=#file12; https://www.wordfence.com/threat-intel/vulnerabilities/id/bfa1192b-34f5-4b71-8fff-14f2d4ac4aca?source=cve
CVE: CVE-2024-10319
Published: 2024-11-05
Description: The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6 via the render function in widgets/content-toggle/layout/frontend.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3179221/xpro-elementor-addons; https://www.wordfence.com/threat-intel/vulnerabilities/id/382a46c2-9fec-4642-93b0-c06b9ed1c086?source=cve
CVE: CVE-2024-9178
Published: 2024-11-05
Description: The XT Floating Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/woo-floating-cart-lite/trunk/xt-framework/includes/customizer/class-customizer.php#L1012; https://plugins.trac.wordpress.org/changeset/3181762/; https://wordpress.org/plugins/woo-floating-cart-lite/#developers
CVE: CVE-2024-51529
Published: 2024-11-05
Description: Data verification vulnerability in the battery module
Impact:  Successful exploitation of this vulnerability may affect function stability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2024/11/
CVE: CVE-2024-51530
Published: 2024-11-05
Description: LaunchAnywhere vulnerability in the account module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2024/11/
CVE: CVE-2024-9657
Published: 2024-11-05
Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip' parameter in all versions up to, and including, 5.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-image-stack.js#L22; https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-logo-grid.js#L22; https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-reading-timer.js#L12
CVE: CVE-2024-9867
Published: 2024-11-05
Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Open Map Widget' marker_content parameter in all versions up to, and including, 5.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3180563/; https://www.wordfence.com/threat-intel/vulnerabilities/id/cca2bd96-ac3c-480c-8fe7-fb5227a093ae?source=cve
CVE: CVE-2024-10263
Published: 2024-11-05
Description: The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/changeset/3179272/tickera-event-ticketing-system; https://www.wordfence.com/threat-intel/vulnerabilities/id/6e5e9249-9705-4cfa-9c8e-2e002190562b?source=cve
CVE: CVE-2024-10840
Published: 2024-11-05
Description: A vulnerability classified as problematic has been found in romadebrian WEB-Sekolah 1.0. Affected is an unknown function of the file /Admin/akun_edit.php of the component Backend. The manipulation of the argument kode leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-74, CWE-79, CWE-707, CWE-79
References: https://github.com/[PII_REDACTED]/a/blob/main/WEB-Sekolah%E5%90%8E%E5%8F%B0%E5%AD%98%E5%82%A8%E5%9E%8Bxss.md; https://vuldb.com/?ctiid.283086; https://vuldb.com/?id.283086
CVE: CVE-2024-7059
Published: 2024-11-05
Description: A high-severity vulnerability that can lead to arbitrary code execution on the system hosting the Web SDK role was found in the Genetec Security Center product line.
CVSS Score: 8.0 (HIGH)
CWE: CWE-470
References: https://resources.genetec.com/security-advisories/high-severity-vulnerability-affecting-security-center-web-sdk-role; https://ressources.genetec.com/bulletins-de-securite/vulnerabilite-de-haute-severite-affectant-le-role-sdk-web-de-security-center
CVE: CVE-2024-10329
Published: 2024-11-05
Description: The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6 via the 'ube_get_page_templates' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the contents of templates that are private.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/ultimate-bootstrap-elements-for-elementor/trunk/inc/functions/core.php#L239; https://plugins.trac.wordpress.org/changeset/3176562/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3af83ec2-9ebb-4cca-8523-8fe9b1517825?source=cve
CVE: CVE-2024-10841
Published: 2024-11-05
Description: A vulnerability classified as critical was found in romadebrian WEB-Sekolah 1.0. Affected by this vulnerability is an unknown functionality of the file /Proses_Kirim.php of the component Mail Handler. The manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-707, CWE-89
References: https://github.com/[PII_REDACTED]/a/blob/main/WEB-Sekolah%E5%90%8E%E5%8F%B0%E5%AD%98%E5%82%A8%E5%9E%8Bxss.md; https://vuldb.com/?ctiid.283087; https://vuldb.com/?id.283087
CVE: CVE-2024-10842
Published: 2024-11-05
Description: A vulnerability, which was classified as problematic, has been found in romadebrian WEB-Sekolah 1.0. Affected by this issue is some unknown functionality of the file /Admin/Proses_Edit_Akun.php of the component Backend. The manipulation of the argument Username_Baru/Password leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-74, CWE-79, CWE-707, CWE-79
References: https://github.com/[PII_REDACTED]/a/blob/main/WEB-Sekolah%E5%90%8E%E5%8F%B0%E5%AD%98%E5%82%A8%E5%9E%8Bxss.md; https://vuldb.com/?ctiid.283088; https://vuldb.com/?id.283088
CVE: CVE-2023-29114
Published: 2024-11-05
Description: System logs could be accessed through web management application due to a lack of access control.


An attacker can obtain the following sensitive information:

•     Wi-Fi access point credentials to which the EV charger can connect.

•     APN web address and credentials.

•     IPSEC credentials.

•     Web interface access credentials for user and admin accounts.

•     JuiceBox system components (software installed, model, firmware version, etc.).

•     C2G configuration details.

•     Internal IP addresses.

•     OTA firmware update configurations (DNS servers).

All the credentials are stored in logs in an unencrypted plaintext format.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE: CVE-2023-29115
Published: 2024-11-05
Description: In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g. reboot).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE: CVE-2024-10844
Published: 2024-11-05
Description: A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affects an unknown part of the file search.php. The manipulation of the argument s leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-707, CWE-89
References: https://github.com/sbm-98/CVE/issues/1; https://vuldb.com/?ctiid.283089; https://vuldb.com/?id.283089
CVE: CVE-2024-10845
Published: 2024-11-05
Description: A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file book_detail.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-707, CWE-89
References: https://github.com/hbuzs/CVE/issues/3; https://vuldb.com/?ctiid.283090; https://vuldb.com/?id.283090
CVE: CVE-2024-50993
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at admin_account.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_39/39.md; https://www.netgear.com/about/security/
CVE: CVE-2024-50994
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component ipv6_fix.cgi via the ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, and ipv6_lan_length parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_36/36.md; https://www.netgear.com/about/security/
CVE: CVE-2024-50995
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the share_name parameter at usb_remote_smb_conf.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_40/40.md; https://www.netgear.com/about/security/
CVE: CVE-2024-50996
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the bpa_server parameter at genie_bpa.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_37/37.md; https://www.netgear.com/about/security/
CVE: CVE-2024-50997
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md; https://www.netgear.com/about/security/
CVE: CVE-2024-50998
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component openvpn.cgi via the openvpn_service_port and openvpn_service_port_tun parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_44/44.md; https://www.netgear.com/about/security/
CVE: CVE-2024-50999
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at password.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_38/38.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51000
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component wireless.cgi via the opmode, opmode_an, and opmode_an_2 parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_35/35.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51001
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the sysDNSHost parameter at ddns.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_41/41.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51002
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the l2tp_user_ip parameter at l2tp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_42/42.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51003
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilities in the component ap_mode.cgi via the apmode_dns1_pri and apmode_dns1_sec parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_49/49.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51004
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 and R7000P v1.3.3.154 were discovered to multiple stack overflow vulnerabilities in the component usb_device.cgi via the cifs_user, read_access, and write_access parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_51/51.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51005
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the share_name parameter at usb_remote_smb_conf.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_50/50.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51006
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the ipv6_static_ip parameter in the ipv6_tunnel function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_46/46.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51007
Published: 2024-11-05
Description: Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at wireless.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_54/54.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51008
Published: 2024-11-05
Description: Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at wiz_dyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_53/53.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51009
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at ether.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_47/47.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51010
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component ap_mode.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_48/48.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51011
Published: 2024-11-05
Description: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at pppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51012
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the ipv6_pri_dns parameter at ipv6_fix.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_45/45.md; https://www.netgear.com/about/security/