CVE Vulnerability Catalog

TP-Link Tapo C520WS v2.6 has a DoS vulnerability in HTTP request path parsing. Failure to account for path expansion during normalization leads to buffer overflow and memory corruption, potentially causing device reboot.

In TP-Link Tapo C520WS v2.6, a stack-based buffer overflow vulnerability was identified in a configuration handling component due to insufficient input validation. An attacker can supply an excessively long value for a vulnerable configuration parameter, causing a stack overflow. Successful exploitation leads to a Denial-of-Service (DoS) condition, causing service crash or device reboot.

TP-Link Tapo C520WS v2.6 has a heap-based buffer overflow in asynchronous parsing of local video streams. An attacker on the same network can send crafted payloads causing memory corruption and denial of service (DoS).

TP-Link Tapo C520WS v2.6 has a heap-based buffer overflow in the HTTP parsing loop when appending segmented request bodies. An attacker on the same network can send crafted payloads causing memory corruption and denial of service (DoS).

In TP-Link Tapo C520WS v2.6, a heap-based buffer overflow vulnerability was identified in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation. An attacker on the same network segment can trigger heap memory corruption by sending crafted payloads, causing write operations beyond allocated buffer boundaries. Successful exploitation leads to a Denial-of-Service (DoS) condition, causing the device process to crash or become unresponsive.

Acronis True Image for Windows before build 42902 has a local privilege escalation vulnerability due to insecure folder permissions.

Rack before versions 3.1.21 and 3.2.6 incorrectly parses the Forwarded header (RFC 7239) by splitting on semicolons before handling quoted-string values. Since quoted values may contain semicolons, the header can be interpreted as multiple Forwarded directives, allowing attackers to smuggle host, proto, for, or by parameters.

Local privilege escalation vulnerability due to DLL hijacking in Acronis True Image (Windows) before build 42902.

Local privilege escalation vulnerability due to DLL hijacking. Affects Acronis True Image for Windows before build 42902.

Rack::Multipart::Parser incorrectly unfolds folded multipart headers, preserving CRLF in parameter values. This can lead to header injection or HTTP response splitting in applications using these values.

A vulnerability has been found in Trendnet TEW-657BRM 1.00.1. The function vpn_drop in the file /setup.cgi is affected by OS command injection via manipulation of the argument policy_name. The attack can be launched remotely and the exploit has been disclosed. The vendor confirmed the product is end-of-life since 2011 and no patch will be released.

A flaw has been found in Trendnet TEW-657BRM 1.00.1. The function vpn_connect in the file /setup.cgi is affected by OS command injection via manipulation of the argument policy_name. The attack can be launched remotely and the exploit has been published. The vendor confirmed the product is end-of-life since 2011 and no patch will be released.

A vulnerability was detected in Trendnet TEW-657BRM 1.00.1. The function ping_test in the file /setup.cgi is affected by OS command injection via manipulation of the argument c4_IPAddr. The attack can be launched remotely and the exploit is now public. The vendor confirmed the product is end-of-life since 2011 and no patch will be released.

An OS command injection vulnerability was found in Trendnet TEW-657BRM router version 1.00.1 in the Edit function of the /setup.cgi file. Manipulating the pcdb_list argument allows remote command execution. The vendor confirmed the product is discontinued and unsupported since 2011.

Signal K Server before version 2.24.0 has a prototype read vulnerability via `from` field bypass. A low-privileged authenticated user can bypass prototype boundary filtering to read internal functions and properties from the global prototype object.

In the Rack library (modular Ruby web server interface) versions prior to 2.2.23, 3.1.21, and 3.2.6, the Rack::Files#fail method sets the Content-Length header using String#size instead of String#bytesize. When the response body contains multibyte UTF-8 characters, the declared length is smaller than the actual bytes sent. An attacker can trigger this mismatch by requesting a non-existent path with percent-encoded UTF-8 characters, leading to incorrect HTTP response framing and potential response desynchronization in deployments relying on the wrong Content-Length value.

In Rack prior to versions 2.2.23, 3.1.21, and 3.2.6, a vulnerability was found in Rack::Sendfile#map_accel_path. Injecting the X-Accel-Mapping header into a regular expression without proper escaping allows an attacker to control the X-Accel-Redirect header, potentially leading to serving unauthorized files via nginx.

Rack before versions 2.2.23, 3.1.21, and 3.2.6 has a denial of service vulnerability due to an unlimited number of byte ranges in the HTTP Range header. An attacker can supply many small overlapping ranges, causing disproportionate CPU, memory, I/O, and bandwidth consumption.

Rack::Static incorrectly evaluates header rules on the raw URL-encoded PATH_INFO, while the file is served after decoding. A request for an encoded variant of a path can bypass the intended security headers.

Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If the root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output.