CVSS: 6.7EPSS: 0%CPEs: 32EXPL: 0CVE-2023-20695
https://notcve.org/view.php?id=CVE-2023-20695
In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07734012 / ALPS07874363 (For MT6880, MT6890, MT6980 and MT6990 only); Issue ID: ALPS07734012 / ALPS07874363 (For MT6880, MT6890, MT6980 and MT6990 only). • https://corp.mediatek.com/product-security-bulletin/May-2023 • CWE-787: Out-of-bounds Write •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-24182
https://notcve.org/view.php?id=CVE-2023-24182
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /system/sshkeys.js. • https://github.com/ABB-EL/external-vulnerability-disclosures/security/advisories/GHSA-7vqh-2r8q-rjg2 https://github.com/openwrt/luci/commit/0186d7eae0e123a409e9919a83fdfecc7945c984 https://github.com/openwrt/luci/commit/588381e2111079265cc3b20af33507052f1b58cb https://github.com/openwrt/luci/commit/aa7938d4cb3a3f889dead894ea19334ad07ade51 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-38333
https://notcve.org/view.php?id=CVE-2022-38333
Openwrt before v21.02.3 and Openwrt v22.03.0-rc6 were discovered to contain two skip loops in the function header_value(). This vulnerability allows attackers to access sensitive information via a crafted HTTP request. Se ha detectado que Openwrt versiones anteriores a v21.02.3 y Openwrt versión v22.03.0-rc6, contienen dos bucles de omisión en la función header_value(). Esta vulnerabilidad permite a atacantes acceder a información confidencial por medio de una petición HTTP diseñada • https://git.openwrt.org/?p=project/cgi-io.git%3Ba=commit%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176 https://git.openwrt.org/?p=project/cgi-io.git%3Ba=commitdiff%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176 https://git.openwrt.org/?p=project/cgi-io.git%3Ba=patch%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176 • CWE-125: Out-of-bounds Read •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-45904
https://notcve.org/view.php?id=CVE-2021-45904
OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen. OpenWrt versión 21.02.1 permite un ataque de tipo XSS por medio de la Pantalla Port Forwards Add Name • https://bugs.openwrt.org/index.php?do=details&task_id=4199 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-45905
https://notcve.org/view.php?id=CVE-2021-45905
OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen. OpenWrt versión 21.02.1 permite un ataque de tipo XSS por medio de la Pantalla Traffic Rules Name • https://bugs.openwrt.org/index.php?do=details&task_id=4199 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •