CVSS: 6.7EPSS: 0%CPEs: 32EXPL: 0CVE-2023-20695
https://notcve.org/view.php?id=CVE-2023-20695
In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07734012 / ALPS07874363 (For MT6880, MT6890, MT6980 and MT6990 only); Issue ID: ALPS07734012 / ALPS07874363 (For MT6880, MT6890, MT6980 and MT6990 only). • https://corp.mediatek.com/product-security-bulletin/May-2023 • CWE-787: Out-of-bounds Write •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-24182
https://notcve.org/view.php?id=CVE-2023-24182
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /system/sshkeys.js. • https://github.com/ABB-EL/external-vulnerability-disclosures/security/advisories/GHSA-7vqh-2r8q-rjg2 https://github.com/openwrt/luci/commit/0186d7eae0e123a409e9919a83fdfecc7945c984 https://github.com/openwrt/luci/commit/588381e2111079265cc3b20af33507052f1b58cb https://github.com/openwrt/luci/commit/aa7938d4cb3a3f889dead894ea19334ad07ade51 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-24181
https://notcve.org/view.php?id=CVE-2023-24181
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm. • https://github.com/ABB-EL/external-vulnerability-disclosures/security/advisories/GHSA-9gqg-pp5p-q9hg https://github.com/openwrt/luci/commit/25983b9fa572a640a7ecd077378df2790266cd61 https://github.com/openwrt/luci/commit/749268a2cad4a08722e30f66a578e254885f450f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-41435
https://notcve.org/view.php?id=CVE-2022-41435
OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted public key comments. Se descubrió que la versión git-22.140.66206-02913be de OpenWRT LuCI contiene una vulnerabilidad de Cross-Site Scripting (XSS) Almacenado en el componente /system/sshkeys.js. Esta vulnerabilidad permite a los atacantes ejecutar scripts web o HTML arbitrarios mediante comentarios de clave pública manipulados. • https://gist.github.com/librick/eacf19bcfc5ca964e0882b4ef9864bf5 https://github.com/openwrt/luci/commit/944b55738e7f9685865d5298248b7fbd7380749e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-38333
https://notcve.org/view.php?id=CVE-2022-38333
Openwrt before v21.02.3 and Openwrt v22.03.0-rc6 were discovered to contain two skip loops in the function header_value(). This vulnerability allows attackers to access sensitive information via a crafted HTTP request. Se ha detectado que Openwrt versiones anteriores a v21.02.3 y Openwrt versión v22.03.0-rc6, contienen dos bucles de omisión en la función header_value(). Esta vulnerabilidad permite a atacantes acceder a información confidencial por medio de una petición HTTP diseñada • https://git.openwrt.org/?p=project/cgi-io.git%3Ba=commit%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176 https://git.openwrt.org/?p=project/cgi-io.git%3Ba=commitdiff%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176 https://git.openwrt.org/?p=project/cgi-io.git%3Ba=patch%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176 • CWE-125: Out-of-bounds Read •