CVE-2024-9782

D-Link DIR-619L B1 formEasySetupWWConfig buffer overflow

A vulnerability was found in D-Link DIR-619L B1 2.06. It has been declared as critical. This vulnerability affects the function formEasySetupWWConfig of the file /goform/formEasySetupWWConfig. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-619l B1 Dir-619l Dir-619l Firmware

CVE-2024-9783

D-Link DIR-619L B1 formLogDnsquery buffer overflow

A vulnerability was found in D-Link DIR-619L B1 2.06. It has been rated as critical. This issue affects the function formLogDnsquery of the file /goform/formLogDnsquery. The manipulation of the argument curTime leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-619l B1 Dir-619l Dir-619l Firmware

CVE-2024-47846

Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Cargo Mediawiki-cargo

CVE-2024-47847

Various XSSes found in Cargo

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Cargo Mediawiki-cargo

CVE-2024-47849

Backticks can allow the usage of not-allowed SQL functions

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Cargo Mediawiki-cargo

CVE-2024-47841

Path traversal when loading stylesheets

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.

CVSS 4.0 · 6.9 Medium EPSS 34.6% KEV · Not listed

Vendors

Wikimedia

Products

Mediawiki-extensions-css Wikimedia-extensions-css

CVE-2024-47833

Session Cookie without Secure and HTTPOnly flags in taipy

Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Avaiga

Products

Taipy

CVE-2024-9803

code-projects Blood Bank Management System blooddetails.php cross site scripting

A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as problematic. This affects an unknown part of the file blooddetails.php. The manipulation of the argument Availibility leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Blood Bank System

CVE-2024-9785

D-Link DIR-619L B1 formSetDDNS buffer overflow

A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. Affected by this vulnerability is the function formSetDDNS of the file /goform/formSetDDNS. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.5% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-619l B1 Dir-619l Dir-619l Firmware

CVE-2024-9786

D-Link DIR-619L B1 formSetLog buffer overflow

A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06. Affected by this issue is the function formSetLog of the file /goform/formSetLog. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.6% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-619l B1 Dir-619l Dir-619l Firmware

CVE-2024-47657

Improper Access Control Vulnerability

This vulnerability exists in the Shilpi Net Back Office due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter dfclientid through API request URLs which could lead to unauthorized access to sensitive information belonging to other users.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Shilpisoft

Products

Net Back Office

CVE-2024-9910

D-Link DIR-619L B1 formSetPassword buffer overflow

A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formSetPassword of the file /goform/formSetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.6% KEV · Not listed

Vendors

Dlink

Products

Dir-619l Dir-619l Firmware

CVE-2024-9911

D-Link DIR-619L B1 formSetPortTr buffer overflow

A vulnerability was found in D-Link DIR-619L B1 2.06. It has been classified as critical. This affects the function formSetPortTr of the file /goform/formSetPortTr. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.6% KEV · Not listed

Vendors

Dlink

Products

Dir-619l Dir-619l Firmware

CVE-2024-47656

User Enumeration vulnerability

This vulnerability exists in Shilpi Client Dashboard due to missing restrictions for incorrect login attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on password, which could lead to gain unauthorized access to other user accounts.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Shilpisoft

Products

Client Dashboard

CVE-2024-9912

D-Link DIR-619L B1 formSetQoS buffer overflow

A vulnerability was found in D-Link DIR-619L B1 2.06. It has been declared as critical. This vulnerability affects the function formSetQoS of the file /goform/formSetQoS. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.6% KEV · Not listed

Vendors

D-link Dlink

Products

202l Dir-619l Dir-619l Firmware

CVE-2024-9913

D-Link DIR-619L B1 formSetRoute buffer overflow

A vulnerability was found in D-Link DIR-619L B1 2.06. It has been rated as critical. This issue affects the function formSetRoute of the file /goform/formSetRoute. The manipulation of the argument curTime leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.7% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-619l B1 Dir-619l Dir-619l Firmware

CVE-2024-9908

D-Link DIR-619L B1 formSetMACFilter buffer overflow

A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06. Affected is the function formSetMACFilter of the file /goform/formSetMACFilter. The manipulation of the argument curTime leads to buffer overflow. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.1 Medium EPSS 2.6% KEV · Not listed

Vendors

Dlink

Products

Dir-619l Dir-619l Firmware

CVE-2024-9909

D-Link DIR-619L B1 formSetMuti buffer overflow

A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formSetMuti of the file /goform/formSetMuti. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 2.2% KEV · Not listed

Vendors

Dlink

Products

Dir-619l Dir-619l Firmware

CVE-2024-9914

D-Link DIR-619L B1 formSetWizardSelectMode buffer overflow

A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06. Affected is the function formSetWizardSelectMode of the file /goform/formSetWizardSelectMode. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.7% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-619l B1 Dir-619l Dir-619l Firmware

CVE-2024-47655

Unrestricted File Upload Vulnerability

This vulnerability exists in the Shilpi Client Dashboard due to improper validation of files being uploaded other than the specified extension. An authenticated remote attacker could exploit this vulnerability by uploading malicious file, which could lead to remote code execution on targeted application.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Shilpisoft

Products

Client Dashboard