Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,302 results · page 39 of 87
Oct 17, 2024A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5.CVE-2024-10072 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. This issue affects the function actionAddEncryptPolicyGroup of the file /com/esafenet/servlet/policy/EncryptPolicyService.java. The manipulation of the argument checklist leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024A vulnerability classified as critical was found in ESAFENET CDG 5.CVE-2024-10071 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in ESAFENET CDG 5. This vulnerability affects the function actionUpdateEncryptPolicyEdit of the file /com/esafenet/servlet/policy/EncryptPolicyService.java. The manipulation of the argument encryptPolicyId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024A vulnerability classified as critical has been found in ESAFENET CDG 5.CVE-2024-10070 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in ESAFENET CDG 5. This affects the function actionPolicyPush of the file /com/esafenet/policy/action/PolicyPushControlAction.java. The manipulation of the argument policyId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024A vulnerability classified as critical has been found in mikexstudios Xcomic up to 0.8.2.CVE-2005-10003 · Other software · mikexstudios · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in mikexstudios Xcomic up to 0.8.2. This affects an unknown part. The manipulation of the argument cmd leads to os command injection. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 0.8.3 is able to address this issue. The patch is named 6ed8e3cc336e29f09c7e791863d0559939da98bf. It is recommended to upgrade the affected component.
- Product
- Xcomic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxcomic.mikexstudios.comgithub.com
Oct 17, 2024Wsify Widget: Cross-Site Request Forgery (CSRF)CVE-2024-48048 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through <= 1.0.
- Product
- Wsify Widget
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Wsify Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2024A vulnerability, which was classified as critical, was found in MitraStar GPT-2541GNAC BR_g5.6_1.11(WVK.0)b26.CVE-2024-9977 · Other software · MitraStar · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, was found in MitraStar GPT-2541GNAC BR_g5.6_1.11(WVK.0)b26. Affected is an unknown function of the file /cgi-bin/settings-firewall.cgi of the component Firewall Settings Page. The manipulation of the argument SrcInterface leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
- Product
- GPT-2541GNAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2024A vulnerability has been found in HuangDou UTCMS V9 and classified as critical.CVE-2024-9918 · Other software · HuangDou · reported by VulDBMedium 5.1
A vulnerability has been found in HuangDou UTCMS V9 and classified as critical. This vulnerability affects the function RunSql of the file app/modules/ut-data/admin/sql.php. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- UTCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2024A vulnerability, which was classified as critical, was found in HuangDou UTCMS V9.CVE-2024-9917 · Other software · HuangDou · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in HuangDou UTCMS V9. This affects an unknown part of the file app/modules/ut-template/admin/template_creat.php. The manipulation of the argument content leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- UTCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2024A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9.CVE-2024-9916 · Other software · HuangDou · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- UTCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2024A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06.CVE-2024-9915 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. Affected by this vulnerability is the function formVirtualServ of the file /goform/formVirtualServ. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2024A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06.CVE-2024-9914 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06. Affected is the function formSetWizardSelectMode of the file /goform/formSetWizardSelectMode. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2024A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical.CVE-2024-9910 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formSetPassword of the file /goform/formSetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2024A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical.CVE-2024-9909 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formSetMuti of the file /goform/formSetMuti. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2024A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06.CVE-2024-9908 · Network & remote access · D-Link · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06. Affected is the function formSetMACFilter of the file /goform/formSetMACFilter. The manipulation of the argument curTime leads to buffer overflow. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2024A vulnerability classified as problematic was found in QileCMS up to 1.1.3.CVE-2024-9907 · Other software · qilecms · reported by VulDBMedium 6.3
A vulnerability classified as problematic was found in QileCMS up to 1.1.3. This vulnerability affects the function sendEmail of the file /qilecms/user/controller/Forget.php of the component Verification Code Handler. The manipulation leads to weak password recovery. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- qilecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Oct 12, 2024A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0.CVE-2024-9904 · Other software · zero_takeoff · reported by VulDBMedium 5.1
A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This vulnerability affects the function pictureUpload of the file /admin/File/pictureUpload. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.
- Product
- 07flycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2024A vulnerability classified as critical has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0.CVE-2024-9903 · Other software · zero_takeoff · reported by VulDBMedium 5.1
A vulnerability classified as critical has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This affects the function fileUpload of the file /admin/File/fileUpload. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.
- Product
- 07flycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A vulnerability was discovered in FBM_292W-21.03.10V, which has been classified as critical.CVE-2024-44414 · Other software · wayos · reported by MITREHigh 8.8
A vulnerability was discovered in FBM_292W-21.03.10V, which has been classified as critical. This issue affects the sub_4901E0 function in the msp_info.htm file. Manipulation of the path parameter can lead to command injection.
- Product
- fbm_292w_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical.CVE-2024-44413 · Other software · dlink · reported by MITREHigh 8.8
A vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_filter.asp file. Manipulation of the path parameter can lead to command injection.
- Product
- di-8200_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability was found in Codezips Tourist Management System 1.0 and classified as critical.CVE-2024-9816 · Other software · Codezips · reported by VulDBMedium 5.1
A vulnerability was found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Tourist Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability has been found in Codezips Tourist Management System 1.0 and classified as critical.CVE-2024-9815 · Other software · Codezips · reported by VulDBMedium 5.1
A vulnerability has been found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/create-package.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Tourist Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability, which was classified as critical, was found in Codezips Pharmacy Management System 1.0.CVE-2024-9814 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Codezips Pharmacy Management System 1.0. Affected is an unknown function of the file product/update.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Pharmacy Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability, which was classified as critical, has been found in Codezips Pharmacy Management System 1.0.CVE-2024-9813 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Codezips Pharmacy Management System 1.0. This issue affects some unknown processing of the file product/register.php. The manipulation of the argument category leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Pharmacy Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability was found in Craig Rodway Classroombookings 2.8.7 and classified as problematic.CVE-2024-9807 · Other software · Craig Rodway · reported by VulDBMedium 5.1
A vulnerability was found in Craig Rodway Classroombookings 2.8.7 and classified as problematic. This issue affects some unknown processing of the file /sessions of the component Session Page. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.8.8 is able to address this issue. It is recommended to upgrade the affected component. The project maintainer was contacted early about the disclosure. He responded very quickly, friendly, and professional.
- Product
- Classroombookings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability has been found in Craig Rodway Classroombookings up to 2.8.6 and classified as problematic.CVE-2024-9806 · Other software · Craig Rodway · reported by VulDBMedium 5.3
A vulnerability has been found in Craig Rodway Classroombookings up to 2.8.6 and classified as problematic. This vulnerability affects unknown code of the file /rooms/fields of the component Room Page. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.8.7 is able to address this issue. It is recommended to upgrade the affected component. The project maintainer was contacted early about the disclosure. He responded very quickly, friendly, and professional.
- Product
- Classroombookings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability, which was classified as critical, has been found in Codezips Online Shopping Portal 1.0.CVE-2024-9794 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Codezips Online Shopping Portal 1.0. This issue affects some unknown processing of the file /update-image1.php. The manipulation of the argument productimage1 leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Shopping Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23.CVE-2024-9793 · Network & remote access · Tenda · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of the file /goform/ate. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1206
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability classified as problematic has been found in D-Link DSL-2750U R5B017.CVE-2024-9792 · Network & remote access · D-Link · reported by VulDBMedium 5.1
A vulnerability classified as problematic has been found in D-Link DSL-2750U R5B017. This affects an unknown part of the component Port Forwarding Page. The manipulation of the argument PortMappingDescription leads to cross site scripting. It is possible to initiate the attack remotely.
- Product
- DSL-2750U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability was found in LyLme_spage 1.9.5 and classified as critical.CVE-2024-9789 · Other software · lylme · reported by VulDBMedium 5.1
A vulnerability was found in LyLme_spage 1.9.5 and classified as critical. This issue affects some unknown processing of the file /admin/apply.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability has been found in LyLme_spage 1.9.5 and classified as critical.CVE-2024-9788 · Other software · lylme · reported by VulDBMedium 5.1
A vulnerability has been found in LyLme_spage 1.9.5 and classified as critical. This vulnerability affects unknown code of the file /admin/tag.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability, which was classified as problematic, was found in Contemporary Control System BASrouter BACnet BASRT-B 2.7.2.CVE-2024-9787 · Other software · Contemporary Control System · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, was found in Contemporary Control System BASrouter BACnet BASRT-B 2.7.2. This affects an unknown part of the component UDP Packet Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BASrouter BACnet BASRT-B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06.CVE-2024-9786 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06. Affected by this issue is the function formSetLog of the file /goform/formSetLog. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06.CVE-2024-9785 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. Affected by this vulnerability is the function formSetDDNS of the file /goform/formSetDDNS. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06.CVE-2024-9784 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06. Affected is the function formResetStatistic of the file /goform/formResetStatistic. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical.CVE-2024-9570 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formEasySetTimezone of the file /goform/formEasySetTimezone. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical.CVE-2024-9569 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formEasySetPassword of the file /goform/formEasySetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06.CVE-2024-9568 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06. Affected is the function formAdvNetwork of the file /goform/formAdvNetwork. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06.CVE-2024-9567 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06. This issue affects the function formAdvFirewall of the file /goform/formAdvFirewall. The manipulation of the argument curTime leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06.CVE-2024-9566 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. This vulnerability affects the function formDeviceReboot of the file /goform/formDeviceReboot. The manipulation of the argument next_page leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical.CVE-2024-9565 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. Affected by this vulnerability is the function formSetPassword of the file /goform/formSetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9564 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA. Affected is the function formWlanWizardSetup of the file /goform/formWlanWizardSetup. The manipulation of the argument webpage leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9563 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA. This issue affects the function formWlanSetup_Wizard of the file /goform/formWlanSetup_Wizard. The manipulation of the argument webpage leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability classified as critical was found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9562 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DIR-605L 2.13B01 BETA. This vulnerability affects the function formSetWizard1/formSetWizard2. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9561 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01 BETA. This affects the function formSetWAN_Wizard51/formSetWAN_Wizard52. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical.CVE-2024-9558 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This issue affects the function formSetWanPPTP of the file /goform/formSetWanPPTP. The manipulation of the argument webpage leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical.CVE-2024-9557 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This vulnerability affects the function formSetWanPPPoE of the file /goform/formSetWanPPPoE. The manipulation of the argument webpage leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9556 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA. This affects the function formSetEnableWizard of the file /goform/formSetEnableWizard. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9555 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA. Affected by this issue is the function formSetEasy_Wizard of the file /goform/formSetEasy_Wizard. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability classified as problematic was found in Sovell Smart Canteen System up to 3.0.7303.30513.CVE-2024-9554 · Other software · Sovell · reported by VulDBMedium 6.3
A vulnerability classified as problematic was found in Sovell Smart Canteen System up to 3.0.7303.30513. Affected by this vulnerability is the function Check_ET_CheckPwdz201 of the file suanfa.py of the component Password Reset Handler. The manipulation leads to authorization bypass. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart Canteen System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9553 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01 BETA. This affects the function formdumpeasysetup of the file /goform/formdumpeasysetup. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.