CVE-2023-38866

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and displayname...

CVE-2023-38865: Improper Neutralization of Special Elements used in a Command

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr...

CVE-2023-38866: Improper Neutralization of Special Elements used in a Command

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and displayname...

CVE-2023-2645

A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Management Page. The manipulation of the argument username/password with the input root leads to use of hard-coded password. It is possible to launch the attac...

CVE-2023-2645

A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Management Page. The manipulation of the argument username/password with the input root leads to use of hard-coded password. It is possible to launch the attac...

CVE-2023-2645

The CVE-2023-2645 entry affects USR-G806 (firmware 1.0.41) and is tied to the Web Management Page. The vulnerability arises from manipulating the username/password arguments with the input root, which leads to the use of a hard-coded password. This enables a remote attack as described in multiple...

CVE-2023-2645 USR USR-G806 Web Management Page hard-coded password

A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Management Page. The manipulation of the argument username/password with the input root leads to use of hard-coded password. It is possible to launch the attac...

CVE-2023-2645: Use of Hard-coded Password

A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Management Page. The manipulation of the argument username/password with the input root leads to use of hard-coded password. It is possible to launch the attac...

CVE-2023-29778

GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread...

CVE-2023-29778

GL.iNET MT3000 4.1.0 Release 2 is documented as vulnerable to an OS Command Injection via the /usr/lib/oui-httpd/rpc/logread endpoint. The affected component is the logread handler in the oui-httpd path; CVSS v3.1 metrics indicate a critical impact (CRITICAL, 9.8) affecting confidentiality, integ...

openSUSE 15 Security Update : amanda (openSUSE-SU-2023:0069-1)

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0069-1 advisory. - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the...

CVE-2022-37704

Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure...

libXpm security update

3.5.12-9 - Fix CVE-2022-46285: infinite loop on unclosed comments 2161800 - Fix CVE-2022-44617: runaway loop with width of 0 2161808 - Fix CVE-2022-4883: compression depends on /usr/local/bin:/usr/bin 2160238...

CVE-2022-44184: Out-of-bounds Write

Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wandns1sec...

CVE-2022-44193: Out-of-bounds Write

Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameters: starthour, startminute , endhour, and endminute...

PT-2025-41036

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An information leak was identified in the Linux kernel related to the tipc topsrv kern subscr function. Specifically, an 8-byte write was not used to initialize the sub.usr handle...

CVE-2022-36560: Use of Hard-coded Credentials

Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain multiple hard-coded passcodes for root. Attackers are able to access the passcodes at /etc/srapi/config/system.conf and /usr/sbin/ssol-sshd.sh...

PT-2022-11574

Name of the Vulnerable Software and Affected Versions TP-Link Archer A7 version Archer A7US V5 210519 Description The issue is caused by a command injection vulnerability in the /usr/bin/tddp program, which takes part of the received data packet as part of the command. This allows an attacker to...

CVE-2021-42232: Improper Neutralization of Special Elements used in an OS Command

TP-Link Archer A7 Archer A7USV5210519 is affected by a command injection vulnerability in /usr/bin/tddp. The vulnerability is caused by the program taking part of the received data packet as part of the command. This will cause an attacker to execute arbitrary commands on the router...

USR IOT 4G LTE Industrial Cellular VPN Router 信任管理问题漏洞

Jinan USR IOT Technology USR IOT 4G LTE Industrial Cellular VPN Router is an industrial-grade 4G wireless LTE router from Jinan USR IOT Technology China. A security vulnerability exists in the USR IOT 4G LTE Industrial Cellular VPN Router version 1.0.36, which originates from the inability to...