Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,303 results · page 47 of 87
Apr 27, 2024A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656).CVE-2024-4245 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656). Affected by this issue is the function formQosManageDouble_user. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be launched remotely. The identifier of this vulnerability is VDB-262136. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A vulnerability classified as critical was found in Tenda W9 1.0.0.7(4456).CVE-2024-4244 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda W9 1.0.0.7(4456). Affected by this vulnerability is the function fromDhcpSetSer of the file /goform/DhcpSetSer. The manipulation of the argument dhcpStartIp/dhcpEndIp/dhcpGw/dhcpMask/dhcpLeaseTime/dhcpDns1/dhcpDns2 leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-262135. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A vulnerability classified as critical has been found in Tenda W9 1.0.0.7(4456).CVE-2024-4243 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda W9 1.0.0.7(4456). Affected is the function formwrlSSIDset of the file /goform/wifiSSIDset. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-262134 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A vulnerability was found in Tenda AX1806 1.0.0.1 and classified as critical.CVE-2024-4239 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this issue is the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument rebootTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-262130 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AX1806
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A vulnerability has been found in Tenda AX1806 1.0.0.1 and classified as critical.CVE-2024-4238 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability has been found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this vulnerability is the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262129 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AX1806
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A vulnerability, which was classified as critical, was found in Tenda AX1806 1.0.0.1.CVE-2024-4237 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda AX1806 1.0.0.1. Affected is the function R7WebsSecurityHandler of the file /goform/execCommand. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262128. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AX1806
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A vulnerability, which was classified as critical, has been found in Tenda AX1803 1.0.0.1.CVE-2024-4236 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda AX1803 1.0.0.1. This issue affects the function formSetSysToolDDNS of the file /goform/SetDDNSCfg. The manipulation of the argument serverName/ddnsUser/ddnsPwd/ddnsDomain leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-262127. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AX1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A vulnerability classified as problematic was found in Netgear DG834Gv5 1.6.01.34.CVE-2024-4235 · Network & remote access · Netgear · reported by VulDBLow 2.7
A vulnerability classified as problematic was found in Netgear DG834Gv5 1.6.01.34. This vulnerability affects unknown code of the component Web Management Interface. The manipulation leads to cleartext storage of sensitive information. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-262126 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DG834Gv5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsecfish.notion.sitevuldb.com
Apr 25, 2024A vulnerability classified as problematic was found in idcCMS 1.35.CVE-2024-4172 · Other software · idccms_project · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in idcCMS 1.35. Affected by this vulnerability is an unknown functionality of the file /admin/admin_cl.php?mudi=revPwd. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261991.
- Product
- idccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024A vulnerability classified as critical has been found in Tenda W30E 1.0/1.0.1.25.CVE-2024-4171 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda W30E 1.0/1.0.1.25. Affected is the function fromWizardHandle of the file /goform/WizardHandle. The manipulation of the argument PPW leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261990 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W30E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024A vulnerability was found in Tenda 4G300 1.01.42 and classified as critical.CVE-2024-4167 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda 4G300 1.01.42 and classified as critical. Affected by this issue is the function sub_422AA4. The manipulation of the argument year/month/day/hour/minute/second leads to stack-based buffer overflow. The attack may be launched remotely. VDB-261986 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 4G300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024A vulnerability has been found in Tenda 4G300 1.01.42 and classified as critical.CVE-2024-4166 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability has been found in Tenda 4G300 1.01.42 and classified as critical. Affected by this vulnerability is the function sub_41E858. The manipulation of the argument GO/page leads to stack-based buffer overflow. The attack can be launched remotely. The identifier VDB-261985 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 4G300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024A vulnerability, which was classified as critical, was found in Tenda G3 15.11.0.17(9502).CVE-2024-4165 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda G3 15.11.0.17(9502). Affected is the function modifyDhcpRule of the file /goform/modifyDhcpRule. The manipulation of the argument bindDhcpIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261984. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- G3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024A vulnerability, which was classified as critical, has been found in Tenda G3 15.11.0.17(9502).CVE-2024-4164 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda G3 15.11.0.17(9502). This issue affects the function formModifyPppAuthWhiteMac of the file /goform/ModifyPppAuthWhiteMac. The manipulation of the argument pppoeServerWhiteMacIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261983. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- G3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Classified Listing – Classified ads & Business Directory: Unauthorized loss of dataCVE-2024-3893 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtcl_fb_gallery_image_delete AJAX action in all versions up to, and including, 3.0.10.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachements.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 3.0.10.3
- What to do
- Affects up to 3.0.10.3. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 24, 2024A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical.CVE-2024-4126 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical. This issue affects the function formSetSysTime of the file /goform/SetSysTimeCfg. The manipulation of the argument manualTime leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261869 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability has been found in Tenda W15E 15.11.0.14 and classified as critical.CVE-2024-4125 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability has been found in Tenda W15E 15.11.0.14 and classified as critical. This vulnerability affects the function formSetStaticRoute of the file /goform/setStaticRoute. The manipulation of the argument staticRouteIndex leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261868. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14.CVE-2024-4124 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14. This affects the function formSetRemoteWebManage of the file /goform/SetRemoteWebManage. The manipulation of the argument remoteIP leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261867. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability, which was classified as critical, has been found in Tenda W15E 15.11.0.14.CVE-2024-4123 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda W15E 15.11.0.14. Affected by this issue is the function formSetPortMapping of the file /goform/SetPortMapping. The manipulation of the argument portMappingServer/portMappingProtocol/portMappingWan/porMappingtInternal/portMappingExternal leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-261866 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability classified as critical was found in Tenda W15E 15.11.0.14.CVE-2024-4122 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda W15E 15.11.0.14. Affected by this vulnerability is the function formSetDebugCfg of the file /goform/setDebugCfg. The manipulation of the argument enable/level/module leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261865 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability classified as critical has been found in Tenda W15E 15.11.0.14.CVE-2024-4121 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda W15E 15.11.0.14. Affected is the function formQOSRuleDel. The manipulation of the argument qosIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-261864. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical.CVE-2024-4117 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical. Affected by this issue is the function formDelPortMapping of the file /goform/DelPortMapping. The manipulation of the argument portMappingIndex leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261860. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability has been found in Tenda W15E 15.11.0.14 and classified as critical.CVE-2024-4116 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability has been found in Tenda W15E 15.11.0.14 and classified as critical. Affected by this vulnerability is the function formDelDhcpRule of the file /goform/DelDhcpRule. The manipulation of the argument delDhcpIndex leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261859. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14.CVE-2024-4115 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14. Affected is the function formAddDnsForward of the file /goform/AddDnsForward. The manipulation of the argument DnsForwardRule leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261858 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W15E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability, which was classified as critical, has been found in Tenda TX9 22.03.02.10.CVE-2024-4114 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda TX9 22.03.02.10. This issue affects the function sub_42C014 of the file /goform/PowerSaveSet. The manipulation of the argument time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261857 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- TX9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability classified as critical was found in Tenda TX9 22.03.02.10.CVE-2024-4113 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda TX9 22.03.02.10. This vulnerability affects the function sub_42D4DC of the file /goform/SetSysTimeCfg. The manipulation of the argument time leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261856. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- TX9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024A vulnerability classified as critical has been found in Tenda TX9 22.03.02.10.CVE-2024-4112 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda TX9 22.03.02.10. This affects the function sub_42CB94 of the file /goform/SetVirtualServerCfg. The manipulation of the argument list leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261855. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- TX9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2024A vulnerability classified as critical has been found in Tenda AC8 16.03.34.09.CVE-2024-4066 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda AC8 16.03.34.09. Affected is the function fromAdvSetMacMtuWan of the file /goform/AdvSetMacMtuWan. The manipulation of the argument wanMTU/wanSpeed/cloneType/mac/serviceName/serverName leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261792. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2024A vulnerability was found in Hualai Xiaofang iSC5 3.2.2_112 and classified as problematic.CVE-2024-4062 · Other software · Hualai Xiaofang · reported by VulDBLow 3.7
A vulnerability was found in Hualai Xiaofang iSC5 3.2.2_112 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper certificate validation. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of this vulnerability is VDB-261788. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- iSC5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2024GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: Stored Cross-Site ScriptingCVE-2024-3732 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gd_single_tabs' shortcode in all versions up to, and including, 2.3.48 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GeoDirectory – WordPress Business Directory Plugin, or Classified Directory
- Affected
- up to 2.3.48
- What to do
- Affects up to 2.3.48. Update GeoDirectory – WordPress Business Directory Plugin, or Classified Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 21, 2024A vulnerability, which was classified as problematic, has been found in l2c2technologies Koha up to 20180108.CVE-2018-25101 · Other software · l2c2technologies · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in l2c2technologies Koha up to 20180108. This issue affects some unknown processing of the file /cgi-bin/koha/opac-MARCdetail.pl. The manipulation of the argument biblionumber with the input 2"><TEST> leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 950fc8e101886821879066b33e389a47fb0a9782. It is recommended to upgrade the affected component. The identifier VDB-261677 was assigned to this vulnerability.
- Product
- Koha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2024A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress.CVE-2015-10132 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress. This vulnerability affects unknown code of the file spreadplugin.php. The manipulation of the argument Spreadplugin leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.8.6.6 is able to address this issue. The name of the patch is a9b9afc641854698e80aa5dd9ababfc8e0e57d69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-261676.
- Affected
- up to 3.8.6.1
- What to do
- Affects up to 3.8.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 20, 2024A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical.CVE-2024-4020 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical. This issue affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument entrys leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- FH1206
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalm-vertebra-fe9.notion.sitevuldb.com
Apr 20, 2024A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411.CVE-2024-4019 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411. Affected is an unknown function of the file /importhtml.php. The manipulation of the argument sql leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261666 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S80 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2024A vulnerability, which was classified as problematic, has been found in COVESA vsomeip up to 3.4.10.CVE-2024-3979 · Other software · COVESA · reported by VulDBMedium 4.4
A vulnerability, which was classified as problematic, has been found in COVESA vsomeip up to 3.4.10. Affected by this issue is some unknown functionality. The manipulation leads to race condition. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261596.
- Product
- vsomeip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A vulnerability classified as problematic has been found in Totara LMS up to 18.7.CVE-2024-3932 · Other software · Totara · reported by VulDBLow 1.3
A vulnerability classified as problematic has been found in Totara LMS up to 18.7. This affects an unknown part of the component User Selector. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 13.46, 14.38, 15.33, 16.27, 17.21 and 18.8 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtotara.communityvuldb.com
Apr 17, 2024A vulnerability, which was classified as critical, has been found in Tenda AC500 2.0.1.9(1307).CVE-2024-3910 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda AC500 2.0.1.9(1307). Affected by this issue is the function fromDhcpListClient of the file /goform/DhcpListClient. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-261146 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A vulnerability classified as critical was found in Tenda AC500 2.0.1.9(1307).CVE-2024-3909 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda AC500 2.0.1.9(1307). Affected by this vulnerability is the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261145 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A vulnerability classified as critical has been found in Tenda AC500 2.0.1.9(1307).CVE-2024-3908 · Network & remote access · Tenda · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Tenda AC500 2.0.1.9(1307). Affected is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261144. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024A vulnerability was found in Tenda W30E 1.0.1.25(633) and classified as critical.CVE-2024-3881 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda W30E 1.0.1.25(633) and classified as critical. This issue affects the function frmL7PlotForm of the file /goform/frmL7ProtForm. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260915. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W30E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024A vulnerability has been found in Tenda W30E 1.0.1.25(633) and classified as critical.CVE-2024-3880 · Network & remote access · Tenda · reported by VulDBMedium 6.3
A vulnerability has been found in Tenda W30E 1.0.1.25(633) and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-260914 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W30E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024A vulnerability, which was classified as critical, was found in Tenda W30E 1.0.1.25(633).CVE-2024-3879 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda W30E 1.0.1.25(633). This affects the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260913 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W30E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024A vulnerability, which was classified as critical, has been found in Tenda F1202 1.2.0.20(408).CVE-2024-3878 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda F1202 1.2.0.20(408). Affected by this issue is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260912. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024A vulnerability classified as critical was found in Tenda F1202 1.2.0.20(408).CVE-2024-3877 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda F1202 1.2.0.20(408). Affected by this vulnerability is the function fromqossetting of the file /goform/fromqossetting. The manipulation of the argument qos leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260911. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024A vulnerability classified as critical has been found in Tenda F1202 1.2.0.20(408).CVE-2024-3876 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromVirtualSer of the file /goform/VirtualSer. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-260910 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024A vulnerability, which was classified as critical, has been found in Vesystem Cloud Desktop up to 20240408.CVE-2024-3804 · Other software · Vesystem · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Vesystem Cloud Desktop up to 20240408. This issue affects some unknown processing of the file /Public/webuploader/0.1.5/server/fileupload2.php. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cloud Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024A vulnerability classified as critical was found in Vesystem Cloud Desktop up to 20240408.CVE-2024-3803 · Other software · Vesystem · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Vesystem Cloud Desktop up to 20240408. This vulnerability affects unknown code of the file /Public/webuploader/0.1.5/server/fileupload.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260776. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cloud Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024AWP Classifieds: Cross-Site Request Forgery (CSRF)CVE-2024-32447 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team AWP Classifieds.This issue affects AWP Classifieds: from n/a through 4.3.1.
- Product
- AWP Classifieds
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update AWP Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 14, 2024A vulnerability, which was classified as problematic, has been found in slowlyo OwlAdmin up to 3.5.7.CVE-2024-3766 · Other software · slowlyo · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, has been found in slowlyo OwlAdmin up to 3.5.7. Affected by this issue is some unknown functionality of the file /admin-api/upload_image of the component Image File Upload. The manipulation of the argument file leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-260606 is the identifier assigned to this vulnerability.
- Product
- OwlAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2024A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R80CVE-2024-3765 · Other software · Xiongmai · reported by VulDBCritical 9.8
A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R80X30-PQ_8M. Affected by this vulnerability is an unknown functionality of the component Sofia Service. The manipulation with the input ff00000000000000000000000000f103250000007b202252657422203a203130302c202253657373696f6e494422203a202230783022207d0a leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260605 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AHB7804R-MH-V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.