Yufan You

5 exploits Active since Mar 2024
CVE-2024-27927 WRITEUP MEDIUM WRITEUP
RSSHub <1.0.0-master.a429472 - Server-Side Request Forgery via Arbitrary HTTP Fetch
RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attacks. The attacker can send malicious requests to a RSSHub server, to make the server send HTTP GET requests to arbitrary destinations and see partial responses. This may lead to leak the server IP address, which could be hidden behind a CDN; retrieving information in the internal network, e.g. which addresses/ports are accessible, the titles and meta descriptions of HTML pages; and denial of service amplification. The attacker could request the server to download some large files, or chain several SSRF requests in a single attacker request.
CVSS 6.5
CVE-2024-37661 WRITEUP MEDIUM WRITEUP
TP-LINK TL-7DR5130 1.0.23 - Traffic Hijacking via Forged ICMP Redirect Messages
TP-LINK TL-7DR5130 v1.0.23 is vulnerable to forged ICMP redirect message attacks. An attacker in the same WLAN as the victim can hijack the traffic between the victim and any remote server by sending out forged ICMP redirect messages.
CVSS 6.3
CVE-2024-37662 WRITEUP MEDIUM WRITEUP
TP-LINK TL-7DR5130 v1.0.23 - TCP Denial of Service or Traffic Hijacking via Forged RST Messages
TP-LINK TL-7DR5130 v1.0.23 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic between the victim and any remote server by sending out forged TCP RST messages to evict NAT mappings in the router.
CVSS 6.3
CVE-2024-37663 WRITEUP MEDIUM WRITEUP
Redmi Router RB03 1.0.57 - Forged ICMP Redirect Traffic Hijacking
Redmi router RB03 v1.0.57 is vulnerable to forged ICMP redirect message attacks. An attacker in the same WLAN as the victim can hijack the traffic between the victim and any remote server by sending out forged ICMP redirect messages.
CVSS 4.1
CVE-2024-37664 WRITEUP MEDIUM WRITEUP
Redmi AX6S Firmware - TCP Denial of Service or Traffic Hijacking via Forged RST Messages
Redmi router RB03 v1.0.57 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic between the victim and any remote server by sending out forged TCP RST messages to evict NAT mappings in the router.
CVSS 5.2