CVE Vulnerability Catalog

A stack-based buffer overflow vulnerability was identified in the Belkin F9K1015 router version 1.00.10 in the formCrossBandSwitch function of the /goform/formCrossBandSwitch file. The attack can be performed remotely by manipulating the webpage argument. The exploit has been made public.

A stack-based buffer overflow vulnerability was found in the Belkin F9K1015 router version 1.00.10 in the formWISP5G function of the /goform/formWISP5G file. The attack can be performed remotely by manipulating the webpage argument. The exploit has been publicly disclosed.

In Tenda i12 version 1.0.0.11(3862), the function formwrlSSIDset in /goform/wifiSSIDset is vulnerable to stack-based buffer overflow via manipulation of arguments index/wl_radio. The attack can be executed remotely, and the exploit is published.

A stack-based buffer overflow vulnerability was detected in Belkin F9K1122 version 1.00.33 in the formWlanSetup function in the file /goform/formWlanSetup. Manipulation of the webpage argument leads to a stack-based buffer overflow. The attack can be performed remotely, and the exploit is publicly available.

A stack-based buffer overflow vulnerability was identified in the Tenda CH22 device version 1.0.0.1 in the formWrlExtraSet function of the /goform/WrlExtraSet file. The attack can be performed remotely by manipulating the GO argument. The exploit has been made public.

A security flaw has been discovered in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertLocalPrecreate in the file /goform/CertLocalPrecreate, where manipulation of the standard argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly released.

Honeywell Handheld Scanners have a missing authentication vulnerability for critical functions. A remote attacker within Bluetooth range of the base station can remotely execute system commands on the host connected to the base station without authentication. Affected models include C1, D1, A1/B1 before specific firmware versions.

SQL injection vulnerability in Kados R10 GreenBee via the filter_user_mail parameter. Attackers can inject malicious SQL to extract or modify database data.

SQL injection vulnerability in Kados R10 GreenBee via the id_project parameter. Attackers can inject malicious SQL to extract or modify database data.

SQL injection vulnerability in Kados R10 GreenBee via the sort_direction parameter. Attackers can inject malicious SQL to extract or modify database data.

SQL injection vulnerability in Kados R10 GreenBee via the id_to_delete parameter. Attackers can inject malicious SQL to extract or modify database data.

SQL injection vulnerability in Kados R10 GreenBee via the language_tag parameter. Attackers can inject malicious SQL to extract or modify database data.

Kados R10 GreenBee has an SQL injection vulnerability in the user2reset parameter, allowing unauthenticated attackers to manipulate database queries. Attackers can send crafted requests with malicious SQL to extract or modify sensitive data.

SQL injection vulnerability in Kados R10 GreenBee via the id_to_modify parameter. Attackers can inject malicious SQL to extract or modify database data.

SQL injection vulnerability in Kados R10 GreenBee via the mng_profile_id parameter. Attackers can inject malicious SQL to extract sensitive database information.

Kados R10 GreenBee has an SQL injection vulnerability via the menu_lev1 parameter, allowing unauthenticated attackers to manipulate database queries.

Core FTP 2.0 build 653 has a DoS vulnerability in the PBSZ command. An unauthenticated attacker can send a malformed PBSZ command with a buffer exceeding 211 bytes, triggering an access violation and crashing the FTP server.

OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter. Attackers can send GET requests to search.php with malicious SQL payloads in the 'where' parameter to extract sensitive database information.

Xlight FTP Server 3.9.1 has an SEH overwrite vulnerability allowing local attackers to crash the application and overwrite SEH pointers via a crafted 428-byte payload in the program execution field of virtual server configuration.

Advance Gift Shop Pro Script 2.0.3 has an SQL injection vulnerability in the 's' parameter of search requests, allowing unauthenticated attackers to execute arbitrary SQL queries. Attackers can extract sensitive database information including version details.