CVE Vulnerability Catalog

Splinterware System Scheduler Pro 5.12 has an insecure file permissions vulnerability that allows low-privilege users to escalate privileges by modifying service executable files. Attackers can rename WService.exe and replace it with a malicious executable that runs with LocalSystem privileges.

A stack-based buffer overflow vulnerability was found in the Edimax EW-7438RPn 1.31 in the formRadius function of the /goform/formRadius file via manipulation of the submit-url argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A stack-based buffer overflow vulnerability was found in the Edimax EW-7438RPn 1.31 in the formAccept function of the /goform/formAccept file via manipulation of the submit-url argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A stack-based buffer overflow vulnerability was found in the Edimax EW-7438RPn 1.31 in the formConnectionSetting function of the /goform/formConnectionSetting file via manipulation of the max_Conn/timeOut arguments. The attack can be initiated remotely, and the exploit has been publicly disclosed.

FoundDream miniclawd up to commit 2d65665046e2222eeea76cafc8570ed546a8c125 contains a command injection vulnerability in the SkillsLoader component. Manipulating the requires.bins argument in /src/application/skills-loader.ts allows remote code execution. The exploit is publicly available. The product does not use versioning, and the project has not responded to the issue report.

Kenik Camera management Panel is vulnerable to Path Traversal. An unauthenticated attacker can send a GET request with an arbitrary file path and read corresponding files on the server.

FoundDream miniclawd up to commit 2d65665046e2222eeea76cafc8570ed546a8c125 contains an OS command injection vulnerability in the ExecTool.execute function in /src/tools/exec.ts. The attack can be launched remotely. The exploit is publicly available. The product does not use versioning, and the project has not responded to the issue.

SQL Injection vulnerability in /user/search.php of SourceCodester Simple POS and Inventory System 1.0. Manipulation of Name argument leads to SQL injection. Remote attack, exploit public.

Buffer overflow vulnerability in the formL2TPSetup function in /goform/formL2TPSetup on Edimax BR-6478AC 1.23. Manipulating the L2TPUserName argument can lead to buffer overflow.

Buffer overflow vulnerability in the formiNICSiteSurvey function in /goform/formiNICSiteSurvey on Edimax BR-6478AC 1.23. Manipulating the selSSID argument can lead to buffer overflow.

A vulnerability in Apache Airflow providers-google causes `ComputeEngineSSHHook` to disable SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to man-in-the-middle attacks. An in-path network attacker can intercept or modify the SSH session.

In the Tenda F1202 router version 1.2.0.20(408), a stack-based buffer overflow exists in the function fromPptpUserAdd of the file /goform/PptpUserAdd. Manipulating the opttype argument can cause a buffer overflow.

In the Tenda F1202 router version 1.2.0.20(408), a stack-based buffer overflow exists in the function formGstDhcpSetSer of the file /goform/GstDhcpSetSerof. Manipulating the dips argument can cause a buffer overflow.

A vulnerability in Tenda F1202 1.2.0.20(408) affects the formWrlExtraSet function in the file /goform/WrlExtraSet. Manipulation of the delno argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability in Tenda F1202 1.2.0.20(408) affects the fromPPTPUserSetting function in the file /goform/PPTPUserSetting. Manipulation of the delno argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.

Command Centre Service installers may log Service Account credentials into log files. This only affects installations using a custom Service Account (not the default Network Service).

Edimax EW-7438RPn version 1.31 is vulnerable to a stack-based buffer overflow in the formWlSiteSurvey function of the /goform/formWlSiteSurvey file in the webs component. Manipulation of the selSSID/submit-url arguments causes the overflow. The attack can be performed remotely and the exploit is publicly available.

Edimax EW-7438RPn version 1.31 is vulnerable to a stack-based buffer overflow in the formHwSet function of the /goform/formHwSet file. Manipulation of multiple arguments such as Anntena, Mcs, regDomain, nic0Addr, and others causes the overflow. The attack can be performed remotely and the exploit is publicly available.

Edimax EW-7438RPn version 1.31 is vulnerable to a stack-based buffer overflow in the formWlanMP function of the /goform/formWlanMP file. Manipulation of multiple arguments such as ateFunc, ateGain, ateTxCount, and others causes the overflow. The attack can be performed remotely and the exploit is publicly available.

In KLiK SocialMediaWebsite 1.0, an injection vulnerability exists in the HTTP POST request parameter handler. The attack can be launched remotely and the exploit is publicly available.