CVE-2022-47126
published 2022-12-30CVE-2022-47126: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.
PriorityP357critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.87%
54.8th percentile
Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tenda | a15_firmware | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2fxh-3j4p-q796: Tenda A15 V15
ghsa_unreviewed·2022-12-30
CVE-2022-47126 [CRITICAL] CWE-787 GHSA-2fxh-3j4p-q796: Tenda A15 V15
Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.
GHSA
Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions
ghsa·2022-11-16
CVE-2022-45379 [HIGH] CWE-326 Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions
Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions
Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the [SHA-1 hash](https://en.wikipedia.org/wiki/SHA-1) of the approved script. SHA-1 no longer meets the security standards for producing a cryptographically secure message digest.
Script Security Plugin 1190.v65867a_a_47126 uses SHA-512 for new whole-script approvals. Previously approved scripts will have their SHA-1 based whole-script approval replaced with a corresponding SHA-512 whole-script approval when the script is next used.
Whole-script approval only stores the SHA-1 or SHA-512 hash, so it is not possible to migrate all previously approved scripts automatically on startup.
Administrators concerned about
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-12-30
Published