CVE Vulnerability Catalog

A stack overflow was discovered in the page parameter in the fromSetIpBind function in Tenda AC1206 V15.03.06.23, F1202 V1.2.0.20(408), and FH1202 V1.2.0.20(408).

A stack overflow was discovered in the deviceId parameter in the saveParentControlInfo function in Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47.

Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the wpapsk_crypto parameter in the fromSetWirelessRepeat function.

Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability in the fromVirtualSer function via the page parameter.

Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability in the fromAddressNat function, caused by the entrys parameter.

Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability in the fromAddressNat function via the page parameter.

Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability via the deviceId parameter in the formSetClientState function.

Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability via the speed_dir parameter in the formSetSpeedWan function.

Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability in the formSetDeviceName function via the deviceId parameter.

The Tenda FH1203 V2.0.1.6 device was found to contain a stack overflow vulnerability in the addWifiMacFilter function related to the deviceId parameter.

Version V2.0.1.6 of the Tenda FH1203 has a stack overflow vulnerability via the ssid parameter in the form_fast_setting_wifi_set function.

XWiki Platform has a vulnerability that allows remote code execution via a cross-site request forgery (CSRF) attack using the REST API. Exploitation of this flaw by a user with programming rights can impact the integrity, availability, and confidentiality of the entire XWiki installation.

The MStore API WordPress plugin before 3.9.8 does not sanitize and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features and uses the woocommerce-appointments plugin.

The MStore API WordPress plugin before version 3.9.9 allows visitors to create user accounts with any role via its REST API endpoint. This is only exploitable if the site owner paid for access to the plugin's pro features.

CVE-2023-3045 describes an improper neutralization of special elements used in an SQL command, leading to SQL Injection in the Tise Technology Parking Web Report application in versions prior to 2.1.

Projectworlds Online Art Gallery Project version 1.0 allows unauthenticated users to perform arbitrary file uploads via the adminHome.php page. There is a dispute regarding the validity of this vulnerability.

CVE-2023-2852 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Softmed SelfPatron versions before 2.0.

The Yontem Informatics Vehicle Tracking System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions before 8.

SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access the system with regular user privilege to read application data and execute submission and approval processes.

SmartSoft SmartBPM.NET has a vulnerability related to the use of a hard-coded machine key. An unauthenticated remote attacker can exploit this key to send serialized payloads to the server to execute arbitrary code and disrupt service.