Suggestions search

All statuses

Filter by:

With package: tests.haskell.upstreamStackHpackVersion

Found 3 matching suggestions

View:

Compact

Detailed

Untriaged

Permalink CVE-2026-4960

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Not Defined (X)
Report Confidence (RC): Reasonable (R)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 2 months ago Activity log

Created suggestion 2 months ago

Tenda AC6 POST Request WizardHandle fromWizardHandle stack-based overflow

A vulnerability was determined in Tenda AC6 15.03.05.16. Affected is the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

References

VDB-353837 | Tenda AC6 POST Request WizardHandle fromWizardHandle stack-based overflow vdb-entrytechnical-description
VDB-353837 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
Submit #777616 | Tenda AC6 AC6 V1.0 V15.03.05.16 Buffer Overflow third-party-advisory
https://lavender-bicycle-a5a.notion.site/Tenda-AC6-WizardHandle-32053a41781f800… exploit
https://www.tenda.com.cn/ product

Affected products

AC6

==15.03.05.16

Matching in nixpkgs

pkgs.replay-node-cli

Time Travel Debugger for Web Development - Node Command Line

nixos-unstable 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
- nixpkgs-unstable 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
- nixos-unstable-small 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
nixos-25.11 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
- nixos-25.11-small 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
- nixpkgs-25.11-darwin 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c

pkgs.tests.haskell.upstreamStackHpackVersion

Test that the stack in Nixpkgs uses the same version of Hpack as the upstream stack release

Package maintainers

@phryneas Lenz Weber <mail@lenzw.de>
@cdepillabout Dennis Gosnell <cdep.illabout@gmail.com>

Untriaged

Permalink CVE-2026-4961

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Not Defined (X)
Report Confidence (RC): Reasonable (R)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 2 months ago Activity log

Created suggestion 2 months ago

Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow

A vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

References

VDB-353838 | Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow vdb-entrytechnical-description
VDB-353838 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
Submit #777617 | Tenda AC6 AC6 V1.0 V15.03.05.16 Buffer Overflow third-party-advisory
https://lavender-bicycle-a5a.notion.site/Tenda-AC6-QuickIndex-32053a41781f80758… exploit
https://www.tenda.com.cn/ product

Affected products

AC6

==15.03.05.16

Matching in nixpkgs

pkgs.replay-node-cli

Time Travel Debugger for Web Development - Node Command Line

nixos-unstable 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
- nixpkgs-unstable 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
- nixos-unstable-small 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
nixos-25.11 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
- nixos-25.11-small 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
- nixpkgs-25.11-darwin 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c

pkgs.tests.haskell.upstreamStackHpackVersion

Test that the stack in Nixpkgs uses the same version of Hpack as the upstream stack release

Package maintainers

@phryneas Lenz Weber <mail@lenzw.de>
@cdepillabout Dennis Gosnell <cdep.illabout@gmail.com>

Dismissed

Permalink CVE-2025-49974

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 11 months, 1 week ago by @fricklerhandwerk Activity log

Created suggestion 11 months, 1 week ago
@fricklerhandwerk dismissed 11 months, 1 week ago

WordPress UpStream: a Project Management Plugin for WordPress plugin <= 2.1.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through 2.1.0.