Comparison Overview

A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the file /bin/httpd. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

• https://vuldb.com/submit/782052
• https://vuldb.com/vuln/355279
• https://vuldb.com/vuln/355279/cti
• https://www.tenda.com.cn/

Wikipedia 12.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of repeated characters into the search bar to trigger an application crash.

• https://www.exploit-db.com/exploits/45324
• https://www.microsoft.com/en-us/p/wikipedia/9wzdncrfhwm4?activetab=pivot%3aoverviewtab

Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.

• https://www.exploit-db.com/exploits/40707

10-Strike LANState 8.8 contains a local buffer overflow vulnerability in structured exception handling that allows local attackers to execute arbitrary code by crafting malicious LSM map files. Attackers can create a specially formatted LSM file with a payload in the ObjCaption parameter that overflows the buffer, overwrites the SEH chain, and executes shellcode when the file is opened in the application.

• https://www.10-strike.com/lanstate/download.shtml
• https://www.10-strike.com/products.shtml
• https://www.exploit-db.com/exploits/45086
• https://www.vulncheck.com/advisories/10-strike-lanstate-local-buffer-overflow-seh

NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending crafted FTP commands. Attackers can connect to the FTP service and send oversized data in response handlers to overwrite SEH pointers and redirect execution to injected shellcode.

• https://en.softonic.com/download/nico-ftp/windows/post-download
• https://www.exploit-db.com/exploits/45442
• https://www.vulncheck.com/advisories/nico-ftp-buffer-overflow-seh