Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
39,009 results · page 391 of 781
Aug 29, 2023A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90.CVE-2023-40890 · Other software · Zbar Project · reported by MITRECritical 9.8
A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.
- Product
- Zbar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackmd.iolists.debian.org
Aug 29, 2023A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90.CVE-2023-40889 · Other software · Zbar Project · reported by MITRECritical 9.8
A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.
- Product
- Zbar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackmd.iolists.debian.org
Aug 29, 2023In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.CVE-2023-40787 · Other software · Bladex · reported by MITRECritical 9.8
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.
- Product
- Springblade
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsword.bladex.cn
Aug 29, 2023Motorola MBTS Site Controller accepts hard-coded backdoor password.CVE-2023-23770 · Other software · Motorola · reported by cert@ncsc.nlCritical 9.4
Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cannot be changed or disabled.
- Product
- MBTS Site Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtetraburst.comtetraburst.com
Aug 29, 2023An issue was discovered in FRRouting FRR 9.0.CVE-2023-41361 · Other software · Frrouting · reported by MITRECritical 9.8
An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version.
- Product
- Frrouting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Aug 29, 2023An issue was discovered in FRRouting FRR through 9.0.CVE-2023-41360 · Other software · Frrouting · reported by MITRECritical 9.1
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.
- Product
- Frrouting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Aug 29, 2023An issue was discovered in FRRouting FRR through 9.0.CVE-2023-41359 · Other software · Frrouting · reported by MITRECritical 9.1
An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during AIGP validation.
- Product
- Frrouting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Aug 28, 2023Theme Volty CMS Blog up to version v4.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single.CVE-2023-39650 · Other software · Themevolty · reported by MITRECritical 9.8
Theme Volty CMS Blog up to version v4.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single.
- Product
- Theme Volty CMS Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgthemevolty.com
Aug 28, 2023theme volty tvcmsvideotab up to v4.0.0 was discovered to contain a SQL injection vulnerability via the component TvcmsVideoTabConfirmDeleteModuleFrontControllerCVE-2023-39652 · Other software · Themevolty · reported by MITRECritical 9.8
theme volty tvcmsvideotab up to v4.0.0 was discovered to contain a SQL injection vulnerability via the component TvcmsVideoTabConfirmDeleteModuleFrontController::run().
- Product
- Theme Volty Video TAB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgthemevolty.com
Aug 28, 2023SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection.CVE-2023-41109 · Other software · Patton · reported by MITRECritical 9.8
SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection.
- Product
- Smartnode Sn200 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 28, 2023ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php.CVE-2023-39560 · Other software · Ectouch · reported by MITRECritical 9.8
ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php.
- Product
- Ectouch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2023Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function sub_90998.CVE-2023-40846 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function sub_90998.
- Product
- ac6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2023User enumeration is found in in PHPJabbers Make an Offer Widget v1.0.CVE-2023-40767 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in in PHPJabbers Make an Offer Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- Make AN Offer Widget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023User enumeration is found in in PHPJabbers Ticket Support Script v3.2.CVE-2023-40766 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- Ticket Support Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023User enumeration is found in PHPJabbers Event Booking Calendar v4.0.CVE-2023-40765 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in PHPJabbers Event Booking Calendar v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- Event Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023User enumeration is found in PHP Jabbers Car Rental Script v3.0.CVE-2023-40764 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in PHP Jabbers Car Rental Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023User enumeration is found in PHPJabbers Taxi Booking Script v2.0.CVE-2023-40763 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in PHPJabbers Taxi Booking Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- Taxi Booking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023User enumeration is found in PHPJabbers Fundraising Script v1.0.CVE-2023-40762 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in PHPJabbers Fundraising Script v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- Fundraising Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023User enumeration is found in PHPJabbers Yacht Listing Script v2.0.CVE-2023-40761 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in PHPJabbers Yacht Listing Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- Yacht Listing Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023User enumeration is found in PHP Jabbers Hotel Booking System v4.0.CVE-2023-40760 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- Hotel Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0.CVE-2023-40759 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- Restaurant Booking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023User enumeration is found in PHPJabbers Document Creator v1.0.CVE-2023-40758 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- Document Creator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023User enumeration is found in PHPJabbers Food Delivery Script v3.1.CVE-2023-40757 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- Food Delivery Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023User enumeration is found in PHPJabbers Callback Widget v1.0.CVE-2023-40756 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in PHPJabbers Callback Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- Callback Widget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the "column" parameter of index.php.CVE-2023-40749 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the "column" parameter of index.php.
- Product
- Food Delivery Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023PHPJabbers Food Delivery Script 3.0 has a SQL injection (SQLi) vulnerability in the "q" parameter of index.php.CVE-2023-40748 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
PHPJabbers Food Delivery Script 3.0 has a SQL injection (SQLi) vulnerability in the "q" parameter of index.php.
- Product
- Food Delivery Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023 Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function.CVE-2023-38029 · Other software · Saho · reported by twcert@cert.org.twCritical 9.8
Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.
- Product
- ADM100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 28, 2023 Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication.CVE-2023-38028 · Other software · Saho · reported by twcert@cert.org.twCritical 9.1
Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data, but can’t control system or disrupt service.
- Product
- ADM100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 28, 2023SpotCam Co., Ltd.CVE-2023-38027 · Other software · SPOTCAM CO., LTD. · reported by twcert@cert.org.twCritical 9.8
SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to perform arbitrary system commands or disrupt service.
- Product
- SpotCam Sense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 28, 2023 SpotCam Co., Ltd.CVE-2023-38026 · Other software · SPOTCAM CO., LTD. · reported by twcert@cert.org.twCritical 9.8
SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.
- Product
- SpotCam FHD 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 28, 2023 SpotCam Co., Ltd.CVE-2023-38025 · Other software · SPOTCAM CO., LTD. · reported by twcert@cert.org.twCritical 9.8
SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to arbitrary system commands or disrupt service.
- Product
- SpotCam FHD 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 28, 2023 SpotCam Co., Ltd.CVE-2023-38024 · Other software · SPOTCAM CO., LTD. · reported by twcert@cert.org.twCritical 9.8
SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.
- Product
- SpotCam FHD 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 25, 2023weblogic-framework is a tool for detecting weblogic vulnerabilities.CVE-2023-40571 · Websites & servers · dream0x01 · reported by GitHubCritical 9.8
weblogic-framework is a tool for detecting weblogic vulnerabilities. Versions 0.2.3 and prior do not verify the returned data packets, and there is a deserialization vulnerability which may lead to remote code execution. When weblogic-framework gets the command echo, it directly deserializes the data returned by the server without verifying it. At the same time, the classloader loads a lot of deserialization calls. In this case, the malicious serialized data returned by the server will cause remote code execution. Version 0.2.4 contains a patch for this issue.
- Product
- weblogic-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2023Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform OS-level privilege escalation via a mCVE-2019-13690 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgcrbug.com
Aug 25, 2023Tenda AC23 Vv16.03.07.45_cn is vulnerable to Buffer Overflow via sub_450A4C function.CVE-2023-40799 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC23 Vv16.03.07.45_cn is vulnerable to Buffer Overflow via sub_450A4C function.
- Product
- ac23
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2023 e-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type.CVE-2023-32757 · Other software · e-Excellence · reported by twcert@cert.org.twCritical 9.8
e-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker without logging the service can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.
- Product
- U-Office Force
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 24, 2023IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php.CVE-2023-39699 · Other software · Icewarp · reported by MITRECritical 9.8
IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.
- Product
- Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgdrive.google.com
Aug 24, 2023A remote unprivileged attacker can intercept the communication via e.g.CVE-2023-4420 · Other software · SICK AG · reported by psirt@sick.deCritical 9.8
A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK LMS5xx. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can exploit this weakness to eavesdrop on the communication between the LMS5xx and the Client, and potentially manipulate the data being transmitted.
- Product
- LMS5xx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or disrupt the functionalCVE-2023-4419 · Other software · SICK AG · reported by psirt@sick.deCritical 9.8
The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or disrupt the functionality of the device.
- Product
- LMS5xx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at /goform/setMacFilCVE-2023-40904 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at /goform/setMacFilterCfg.
- Product
- ac10v4_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBind.CVE-2023-40902 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBind.
- Product
- ac10v4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at url /goform/setMaCVE-2023-40901 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at url /goform/setMacFilterCfg.
- Product
- ac10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetNetControlList.CVE-2023-40900 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetNetControlList.
- Product
- ac8v4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at /goform/setMacFilteCVE-2023-40899 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at /goform/setMacFilterCfg.
- Product
- ac8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter timeZone at /goform/SetSysTimeCfg.CVE-2023-40898 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter timeZone at /goform/SetSysTimeCfg.
- Product
- ac8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter mac at /goform/GetParentControlInfo.CVE-2023-40897 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter mac at /goform/GetParentControlInfo.
- Product
- ac8v4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBind.CVE-2023-40896 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBind.
- Product
- ac8v4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetVirtualServerCfg.CVE-2023-40895 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetVirtualServerCfg.
- Product
- ac8v4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetStaticRouteCfg.CVE-2023-40894 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetStaticRouteCfg.
- Product
- ac8v4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter time at /goform/PowerSaveSet.CVE-2023-40893 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter time at /goform/PowerSaveSet.
- Product
- ac8v4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.