Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,303 results · page 46 of 87
May 16, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000-40 V31R02B1413C.CVE-2024-4963 · Network & remote access · D-Link · reported by VulDBMedium 5.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000-40 V31R02B1413C. This affects an unknown part of the file /url/url.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264531. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-7000-40
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
May 16, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000-40 V31R02B1413C.CVE-2024-4962 · Network & remote access · D-Link · reported by VulDBMedium 5.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000-40 V31R02B1413C. Affected by this issue is some unknown functionality of the file /useratte/resmanage.php. The manipulation of the argument file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-264530 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-7000-40
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
May 16, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-7000-40 V31R02B1413C.CVE-2024-4961 · Network & remote access · D-Link · reported by VulDBMedium 5.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-7000-40 V31R02B1413C. Affected by this vulnerability is an unknown functionality of the file /user/onlineuser.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264529 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-7000-40
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
May 16, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000-40 V31R02B1413C.CVE-2024-4960 · Network & remote access · D-Link · reported by VulDBMedium 5.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000-40 V31R02B1413C. Affected is an unknown function of the file interface/sysmanage/licenseauthorization.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264528. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-7000-40
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
May 15, 2024A vulnerability has been found in Codezips E-Commerce Site 1.0 and classified as critical.CVE-2024-4923 · Websites & servers · Codezips · reported by VulDBMedium 5.3
A vulnerability has been found in Codezips E-Commerce Site 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/addproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264460.
- Product
- E-Commerce Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240506.CVE-2024-4816 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240506. This affects an unknown part of the file /view/networkConfig/GRE/gre_add_commit.php. The manipulation of the argument name/remote/local/IP leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263937 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240506.CVE-2024-4815 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240506. Affected by this issue is some unknown functionality of the file /view/bugSolve/viewData/detail.php. The manipulation of the argument filename leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263936. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240506.CVE-2024-4814 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240506. Affected by this vulnerability is an unknown functionality of the file /view/networkConfig/RouteConfig/StaticRoute/static_route_edit_commit.php. The manipulation of the argument oldipmask/oldgateway leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263935. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240506.CVE-2024-4813 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240506. Affected is an unknown function of the file /view/networkConfig/physicalInterface/interface_commit.php. The manipulation of the argument name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-263934 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A vulnerability classified as critical was found in Contemporary Control System BASrouter BACnet BASRT-B 2.7.2.CVE-2024-4791 · Other software · Contemporary Control System · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in Contemporary Control System BASrouter BACnet BASRT-B 2.7.2. This vulnerability affects unknown code of the component Application Protocol Data Unit. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263890 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BASrouter BACnet BASRT-B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A vulnerability classified as problematic has been found in DedeCMS 5.7.114.CVE-2024-4790 · Other software · Dedecms · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in DedeCMS 5.7.114. This affects an unknown part of the file /sys_verifies.php?action=view. The manipulation of the argument filename with the input ../../../../../etc/passwd leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263889 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230922.CVE-2024-4699 · Network & remote access · D-Link · reported by VulDBMedium 5.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230922. This issue affects some unknown processing of the file /importhtml.php. The manipulation of the argument sql leads to deserialization. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-263747. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-8000-10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
May 14, 2024Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the Bluetooth stack component.CVE-2024-33454 · Other software · espressif · reported by MITREMedium 6.5
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the Bluetooth stack component.
- Product
- esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 8, 2024A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1 and classified as critical.CVE-2024-4653 · Other software · BlueNet Technology · reported by VulDBMedium 6.3
A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1 and classified as critical. Affected by this issue is some unknown functionality of the file /xds/outIndex.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263498 is the identifier assigned to this vulnerability.
- Product
- Clinical Browsing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability was found in Kimai up to 2.15.0 and classified as problematic.CVE-2024-4596 · Other software · Kimai · reported by VulDBLow 3.7
A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Session Handler. The manipulation of the argument PHPSESSIONID leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.16.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-263318 is the identifier assigned to this vulnerability.
- Product
- Kimai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability has been found in SEMCMS up to 4.8 and classified as critical.CVE-2024-4595 · Other software · sem-cms · reported by VulDBMedium 6.3
A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is the function locate of the file function.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263317 was assigned to this vulnerability.
- Product
- semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.CVE-2024-4594 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. Affected is an unknown function of the file /src/dede/sys_safe.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263316. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7.CVE-2024-4593 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7. This issue affects some unknown processing of the file /src/dede/sys_multiserv.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263315. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability classified as problematic was found in DedeCMS 5.7.CVE-2024-4592 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in DedeCMS 5.7. This vulnerability affects unknown code of the file /src/dede/sys_group_edit.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability classified as problematic has been found in DedeCMS 5.7.CVE-2024-4591 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/sys_group_add.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263313 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability was found in DedeCMS 5.7 and classified as problematic.CVE-2024-4587 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability was found in DedeCMS 5.7 and classified as problematic. This issue affects some unknown processing of the file /src/dede/tpl.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263309 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability has been found in DedeCMS 5.7 and classified as problematic.CVE-2024-4586 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/shops_delivery.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263308. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.CVE-2024-4585 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/member_type.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263307. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability, which was classified as problematic, has been found in Faraday GM8181 and GM828x up to 20240429.CVE-2024-4584 · Other software · Faraday · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in Faraday GM8181 and GM828x up to 20240429. Affected by this issue is some unknown functionality of the file /command_port.ini. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263306 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- GM8181
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsecfish.notion.sitevuldb.com
May 7, 2024A vulnerability classified as problematic was found in Faraday GM8181 and GM828x up to 20240429.CVE-2024-4583 · Other software · Faraday · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Faraday GM8181 and GM828x up to 20240429. Affected by this vulnerability is an unknown functionality of the component Request Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-263305 was assigned to this vulnerability.
- Product
- GM8181
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfile.notion.sonetsecfish.notion.site
May 7, 2024A vulnerability classified as critical has been found in Faraday GM8181 and GM828x up to 20240429.CVE-2024-4582 · Other software · Faraday · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Faraday GM8181 and GM828x up to 20240429. Affected is an unknown function of the component NTP Service. The manipulation of the argument ntp_srv leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-263304.
- Product
- GM8181
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfile.notion.sonetsecfish.notion.site
May 5, 2024A vulnerability classified as critical has been found in Shanghai Sunfull Automation BACnet Server HMI1002-ARM 2.0.4.CVE-2024-4511 · Other software · Shanghai Sunfull Automation · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Shanghai Sunfull Automation BACnet Server HMI1002-ARM 2.0.4. This affects an unknown part of the component Message Handler. The manipulation leads to buffer overflow. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263115. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BACnet Server HMI1002-ARM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability was found in Ruijie RG-UAC up to 20240428 and classified as critical.CVE-2024-4507 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability was found in Ruijie RG-UAC up to 20240428 and classified as critical. This issue affects some unknown processing of the file /view/IPV6/ipv6StaticRoute/static_route_add_ipv6.php. The manipulation of the argument text_prefixlen/text_gateway/devname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263111. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability has been found in Ruijie RG-UAC up to 20240428 and classified as critical.CVE-2024-4506 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability has been found in Ruijie RG-UAC up to 20240428 and classified as critical. This vulnerability affects unknown code of the file /view/IPV6/ipv6Addr/ip_addr_edit_commit.php. The manipulation of the argument text_ip_addr/orgprelen/orgname leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263110 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240428.CVE-2024-4505 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240428. This affects an unknown part of the file /view/IPV6/ipv6Addr/ip_addr_add_commit.php. The manipulation of the argument prelen/ethname leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263109 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240428.CVE-2024-4504 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240428. Affected by this issue is some unknown functionality of the file /view/HAconfig/baseConfig/commit.php. The manipulation of the argument peer_ip/local_ip leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263108. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240428.CVE-2024-4503 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240428. Affected by this vulnerability is an unknown functionality of the file /view/dhcp/dhcpConfig/dhcp_relay_commit.php. The manipulation of the argument interface_from leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263107. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240428.CVE-2024-4502 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240428. Affected is an unknown function of the file /view/dhcp/dhcpClient/dhcp_client_commit.php. The manipulation of the argument ifName leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263106 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability was found in Tenda i21 1.0.0.14(4656) and classified as critical.CVE-2024-4495 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda i21 1.0.0.14(4656) and classified as critical. Affected by this issue is the function formWifiMacFilterGet. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263084. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability has been found in Tenda i21 1.0.0.14(4656) and classified as critical.CVE-2024-4494 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability has been found in Tenda i21 1.0.0.14(4656) and classified as critical. Affected by this vulnerability is the function formSetUplinkInfo of the file /goform/setUplinkInfo. The manipulation of the argument pingHostIp2 leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263083. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2024A vulnerability, which was classified as critical, was found in Tenda i21 1.0.0.14(4656).CVE-2024-4493 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda i21 1.0.0.14(4656). Affected is the function formSetAutoPing. The manipulation of the argument ping1/ping2 leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263082 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2024A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656).CVE-2024-4492 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656). This issue affects the function formOfflineSet of the file /goform/setStaOffline. The manipulation of the argument GO/ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263081 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2024A vulnerability classified as critical was found in Tenda i21 1.0.0.14(4656).CVE-2024-4491 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda i21 1.0.0.14(4656). This vulnerability affects the function formGetDiagnoseInfo. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263080. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024A vulnerability, which was classified as problematic, was found in osCommerce 4.CVE-2024-4348 · Websites & servers · oscommerce · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in osCommerce 4. Affected is an unknown function of the file /catalog/all-products. The manipulation of the argument cat leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262488. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- oscommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024A vulnerability was found in MailCleaner up to 2023.03.14 and classified as problematic.CVE-2024-3194 · Other software · Mailcleaner · reported by VulDBMedium 4.3
A vulnerability was found in MailCleaner up to 2023.03.14 and classified as problematic. Affected by this issue is some unknown functionality of the component Log File Endpoint. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-262310 is the identifier assigned to this vulnerability.
- Product
- Mailcleaner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024A vulnerability has been found in MailCleaner up to 2023.03.14 and classified as critical.CVE-2024-3193 · Other software · Mailcleaner · reported by VulDBHigh 8.8
A vulnerability has been found in MailCleaner up to 2023.03.14 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Admin Endpoints. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier VDB-262309 was assigned to this vulnerability.
- Product
- Mailcleaner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14.CVE-2024-3192 · Other software · Mailcleaner · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interface. The manipulation as part of Mail Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308.
- Product
- Mailcleaner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14.CVE-2024-3191 · Other software · mailcleaner · reported by VulDBCritical 9.8
A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the component Email Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262307.
- Product
- mailcleaner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2024A vulnerability classified as critical has been found in Contemporary Controls BASrouter BACnet BASRT-B 2.7.2.CVE-2024-4292 · Other software · Contemporary Controls · reported by VulDBMedium 6.5
A vulnerability classified as critical has been found in Contemporary Controls BASrouter BACnet BASRT-B 2.7.2. Affected is an unknown function of the component Device-Communication-Control Service. The manipulation with the input 55ff0500370015f30104025506110afb7519035d0841e4bece257b6acfc71f leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262224. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BASrouter BACnet BASRT-B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2024A vulnerability was found in Techkshetra Info Solutions Savsoft Quiz 6.0 and classified as problematic.CVE-2024-4256 · Other software · Techkshetra Info Solutions · reported by VulDBLow 2.4
A vulnerability was found in Techkshetra Info Solutions Savsoft Quiz 6.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /public/index.php/Qbank/editCategory of the component Category Page. The manipulation of the argument category_name with the input ><script>alert('XSS')</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262148. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Savsoft Quiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2024A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240419.CVE-2024-4255 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240419. This issue affects some unknown processing of the file /view/network Config/GRE/gre_edit_commit.php. The manipulation of the argument name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262145 was assigned to this vulnerability.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2024A vulnerability classified as critical has been found in Tenda i22 1.0.0.3(4687).CVE-2024-4252 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda i22 1.0.0.3(4687). This affects the function formSetUrlFilterRule. The manipulation of the argument groupIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-262143. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2024A vulnerability was found in Tenda i21 1.0.0.14(4656) and classified as critical.CVE-2024-4248 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda i21 1.0.0.14(4656) and classified as critical. This issue affects the function formQosManage_user. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-262139. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2024A vulnerability has been found in Tenda i21 1.0.0.14(4656) and classified as critical.CVE-2024-4247 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability has been found in Tenda i21 1.0.0.14(4656) and classified as critical. This vulnerability affects the function formQosManage_auto. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack can be initiated remotely. VDB-262138 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2024A vulnerability, which was classified as critical, was found in Tenda i21 1.0.0.14(4656).CVE-2024-4246 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda i21 1.0.0.14(4656). This affects the function formQosManageDouble_auto. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The identifier VDB-262137 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.