CVE Vulnerability Catalog

A buffer overflow vulnerability was found in Edimax EW-7438RPn up to version 1.31 in the formWirelessTbl function of /goform/formWirelessTbl. The attack can be launched remotely and the exploit is public.

A buffer overflow vulnerability was found in Edimax EW-7438RPn up to version 1.31 in the formWizSurvey function of /goform/formWizSurvey. Manipulation of the ssid/manualssid/ip/mask/gateway arguments leads to buffer overflow. The attack is remotely exploitable and the exploit is public. The vendor did not respond.

A stack-based buffer overflow vulnerability was detected in Edimax EW-7438RPn up to version 1.31 in the formWpsStart function of /goform/formWpsStart. The attack can be launched remotely and the exploit is public.

A vulnerability in D-Link DIR601 version 2.02NA allows unauthenticated attackers to retrieve sensitive configuration data by manipulating the table_name parameter in POST requests. Attackers can send requests to /my_cgi.cgi with table_name values like admin_user, wireless_settings, and wireless_security to extract administrative credentials and wireless network keys in clear text.

SIPp 3.6 and earlier has a local buffer overflow vulnerability in command-line argument handling. Attackers can supply oversized input to the -3pcc, -i, or -log_file parameters, causing strcpy to write beyond buffer boundaries in sipp.cpp, potentially leading to arbitrary code execution.

Audiograbber 1.83 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Attackers can craft malicious input in the Interpret or Album fields that triggers a buffer overflow, overwriting SEH pointers and executing injected shellcode with application privileges.

Vulnerability in Redaxo CMS Mediapool Addon version 5.5.1 and older – authenticated users can bypass the file extension blacklist by uploading executable files with obfuscated extensions (e.g., php71, php53), allowing arbitrary code execution.

WordPress Ultimate Form Builder Lite plugin version 1.3.7 and below has an SQL injection vulnerability allowing authenticated attackers to manipulate database queries via the entry_id POST parameter. Attackers can send POST requests to admin-ajax.php with the ufbl_get_entry_detail_action action to extract, modify data, or escalate privileges in the WordPress database.

Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the username parameter.

The Ek Rishta 2.10 component for Joomla! contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cid parameter. Attackers can send GET requests to the user_detail view with malicious cid values containing SQL commands to extract sensitive database information.

WordPress Contact Form Maker Plugin version 1.12.20 has SQL injection vulnerabilities allowing authenticated attackers to manipulate database queries via the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.

WordPress Form Maker Plugin version 1.12.24 and below contains SQL injection vulnerabilities allowing authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.

A local buffer overflow vulnerability exists in 10-Strike Network Scanner 3.0 in the host name field, allowing attackers to bypass SafeSEH protections and execute arbitrary code. Malicious payloads in the host name or address field trigger the flaw via Trace route or System information functions.

10-Strike Network Inventory Explorer 8.54 contains a stack-based buffer overflow vulnerability in the registration key input field that allows local attackers to execute arbitrary code by triggering a structured exception handler overwrite. Attackers can craft a malicious registration key string with 4188 bytes of padding followed by SEH chain values and shellcode, then paste it into the registration dialog to achieve code execution with application privileges.

Smartshop 1 contains a time-based blind SQL injection vulnerability allowing unauthenticated attackers to manipulate database queries via the 'searched' parameter in search.php. Attackers can send GET requests with SQL payloads like SLEEP to extract sensitive data.

Smartshop 1 contains a SQL injection vulnerability allowing unauthenticated attackers to execute arbitrary SQL queries via the id parameter in product.php. Attackers can send GET requests with union-based SQL payloads to extract sensitive data like usernames and database names.

Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to category.php with UNION-based SQL injection payloads in the id parameter to extract sensitive database information including usernames.

A vulnerability was found in the Linux kernel's network packet fragment transfer helpers. Functions __pskb_copy_fclone() and skb_shift() fail to propagate the SKBFL_SHARED_FRAG flag, causing the destination socket buffer to not report shared pages. This can lead to writing into the page cache of read-only files by an unprivileged user.

A buffer overflow vulnerability was found in Edimax BR-6428NS version 1.10 in the formWirelessTbl function of /goform/formWirelessTbl. Manipulation of the vapurl argument leads to buffer overflow. The attack is remotely exploitable and the exploit is public. The vendor did not respond.