CVE Vulnerability Catalog

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4) that is vulnerable to SQL injection. This could allow unauthenticated remote attackers to execute arbitrary SQL queries on the server database.

CVE-2023-3898 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in mAyaNet E-Commerce Software versions before 1.1.

In PHOENIX CONTACT's WP 6xxx series web panels in versions prior to 4.0.10, a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request related to date/time operations to gain full access to the device.

In PHOENIX CONTACT's TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10, there is a vulnerability to reflective XSS in the license viewer page. An unauthenticated remote attacker could exploit this vulnerability to execute code in the context of the user's browser.

The log_blackbox.c file in libqb before version 2.0.8 has a buffer overflow vulnerability due to long log messages, as the header size is not considered.

SAP PowerDesigner version 16.7 has improper access control which might allow an unauthenticated attacker to run arbitrary queries against the back-end database via Proxy.

PrestaShop is an open source e-commerce application that is vulnerable to remote code execution through SQL injection and arbitrary file write in the back office in versions prior to 1.7.8.10, 8.0.5, and 8.1.1.

Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6, and FH1205 V2.0.0.7 were found to contain a stack overflow vulnerability via the ssid parameter in the form_fast_setting_wifi_set function.

Tenda F1202 V1.2.0.9 and FH1202 V1.2.0.9 were found to have a stack overflow vulnerability via the mit_ssid parameter in the formWrlsafeset function.

Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5, and FH1202 V1.2.0.9 were found to have a stack overflow vulnerability via the page parameter at /L7Im.

Tenda AC10, AC1206, AC8, AC6, AC7, AC5, AC9, and AC10 v4.0 devices were found to contain a stack overflow via the list parameter in the formSetVirtualSer function.

Tenda AC10, AC1206, AC6, AC7, AC5, FH1203, AC9, and FH1205 devices were found to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan function.

Tenda AC1206, AC8, AC5, AC10, and AC9 devices were found to contain a buffer overflow vulnerability in the formSetQosBand function via the list parameter.

Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6, and FH1205 V2.0.0.7 were found to have a stack overflow vulnerability via the deviceId parameter in the formSetDeviceName function.

Tenda AC6 V2.0, AC7 V1.0, F1203, AC5, FH1203, AC9, and FH1205 devices were found to contain a stack overflow via the deviceId parameter in the formSetClientState function.

Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5, and FH1202 V1.2.0.9 were found to have a stack overflow vulnerability via the page parameter in the SafeEmailFilter function.

Devices Tenda AC10, AC1206, AC8, AC6, AC7, F1203, AC5, and FH1203 were found to contain a stack overflow via the list parameter in the setaccount function.

Tenda AC7, AC5, AC9, and FH1205 devices were found to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.

Version 1.01.42 of the Tenda 4G300 was found to contain a stack overflow via the page parameter at /VirtualSer.

A command injection vulnerability was discovered in Netgear R7100LG version 1.0.0.78 via the password parameter at usb_remote_invite.cgi.