CVE-2024-7160

A vulnerability classified as critical has been found in TOTOLINK A3700R 9.1.2u.5822B20200513. Affected is the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to command injection. It is possible to launch the attack remotely. The exploit has...

CVE-2024-7156: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513 and classified as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/ExportSettings.sh of the component apmib Configuration Handler. The manipulation leads to information disclosure. The attack m...

PT-2024-38122 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3700R version 9.1.2u.5822 B20200513 Description: A critical issue has been found, affecting the setWanCfg function of the file /cgi-bin/cstecgi.cgi. The manipulation of the hostName argument leads to command injection. This issue ca...

CVE-2024-7157: Buffer Copy without Checking Size of Input

A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050B20200504. It has been classified as critical. This affects the function getSaveConfig of the file /cgi-bin/cstecgi.cgi?action=save&setting. The manipulation of the argument httphost leads to buffer overflow. It is possible to initiate the...

CVE-2024-7159: Use of Hard-coded Password

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182B20201102. It has been rated as critical. This issue affects some unknown processing of the file /webcste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. The exploit has been...

CVE-2024-7158: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument telnetenabled leads to command...

CVE-2024-7160: Improper Neutralization of Special Elements used in a Command

A vulnerability classified as critical has been found in TOTOLINK A3700R 9.1.2u.5822B20200513. Affected is the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to command injection. It is possible to launch the attack remotely. The exploit has...

Exploit for OS Command Injection in Php

CVE-2024-4577-PHP-RCE Project Overview and Mechanism - Th...

httpd: Substitution encoding issue in mod_rewrite

A flaw was found in the modrewrite module of httpd. Due to a substitution encoding issue, specially crafted requests may allow an attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant only to be execut...

httpd: Substitution encoding issue in mod_rewrite

A flaw was found in the modrewrite module of httpd. Due to a substitution encoding issue, specially crafted requests may allow an attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant only to be execut...

httpd: Substitution encoding issue in mod_rewrite

A flaw was found in the modrewrite module of httpd. Due to a substitution encoding issue, specially crafted requests may allow an attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant only to be execut...

PT-2024-5383

Name of the Vulnerable Software and Affected Versions TOTOLINK N350RT version 9.3.5u.6139 B20201216 Description A critical issue affects the setWizardCfg function of the /cgi-bin/cstecgi.cgi file, where the manipulation of the ssid argument leads to a buffer overflow. This can be exploited...

CVE-2024-38944: Improper Control of Generation of Code

An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 component...

CVE-2024-38944

An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 component...

CVE-2024-38944

The Intelight X-1L Traffic controller Maxtime (version 1.9.x , specifically v.1.9.6 ) contains an authentication bypass vulnerability within its web-based UI. The flaw allows remote attackers to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 component because the system fails...

RHEL 9 : ruby (RHSA-2024:4542)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4542 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks...

Exploit for OS Command Injection in Php

PoC exploit for CVE-2024-4577, a vulnerability in an unspecified...

BIT-APACHE-2024-38474 Apache HTTP Server weakness with encoded question marks in backreferences

Substitution encoding issue in modrewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to...

Zyxel NAS Export CGI Code Execution

The vulnerability of the export-cgi and fileupload-cgi implementations of the backup and configuration restoration functions for Zyxel NAS326 and Zyxel NAS542 network storage devices is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows an attacker to bypass...

CVE-2024-38474

A flaw was found in the modrewrite module of httpd. Due to a substitution encoding issue, specially crafted requests may allow an attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant only to be execut...