11618 matches found
PT-2025-41188
Name of the Vulnerable Software and Affected Versions Anki versions prior to 25.02.5 Description A specially crafted shared deck on Windows can lead to the execution of arbitrary commands when playing audio due to improper handling of URL schemes. Recommendations Update to version 25.02.5 or late...
Ankitects Anki 安全漏洞
Ankitects Anki is an open source program by the individual developers of Ankitects to help memorize information through the use of flash cards. A security vulnerability exists in Ankitects Anki versions prior to 25.02.5, which stems from improper handling of the URL scheme and could lead to the...
CVE-2025-54405: Improper Neutralization of Special Elements used in an OS Command
Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command...
Planet WGR-500 swctrl OS command injection vulnerabilities
Talos Vulnerability Report TALOS-2025-2227 Planet WGR-500 swctrl OS command injection vulnerabilities October 7, 2025 CVE Number CVE-2025-54404,CVE-2025-54403 SUMMARY Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially...
CVE-2025-54406: Improper Neutralization of Special Elements used in an OS Command
Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command...
Dell PowerProtect Data Domain 操作系统命令注入漏洞
Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. An operating system command injection vulnerability exists in Dell PowerProtect Data Domain, which stems from improper neutralization of...
Planet WGR-500 安全漏洞
The Planet WGR-500 is a WiFi router from Planet in Taiwan, China. A security vulnerability exists in Planet WGR-500 v1.3411b190912, which stems from improper manipulation of the ipaddr request parameter, and could lead to arbitrary command execution...
Planet WGR-500 安全漏洞
The Planet WGR-500 is a WiFi router from Planet in Taiwan, China. A security vulnerability exists in Planet WGR-500 v1.3411b190912, which stems from improper manipulation of the newdevicename request parameter, which could lead to arbitrary command execution...
CVE-2025-54403: Improper Neutralization of Special Elements used in an OS Command
Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is related ...
CVE-2025-36565: Improper Neutralization of Argument Delimiters in a Command
Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Argument Delimiters in a...
Dell PowerProtect Data Domain 操作系统命令注入漏洞
Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. An operating system command injection vulnerability exists in Dell PowerProtect Data Domain, which stems from improper neutralization of...
CVE-2025-54404: Improper Neutralization of Special Elements used in an OS Command
Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is related ...
CVE-2025-43906: Improper Neutralization of Special Elements used in an OS Command
Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Neutralizatio...
EUVD-2025-32574
IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input...
The vulnerability of the sub_412E7C() function in the /goform/set_switch_settings file of the D-Link DIR-823X router’s microprogramming software allows a hacker to execute arbitrary commands.
The vulnerability of the sub412E7C function in the /goform/setswitchsettings function of the D-Link DIR-823X router’s microprogramming software is related to the lack of measures taken to protect data at the control level. Exploiting this vulnerability could allow an attacker to execute arbitrary...
The vulnerability of the /goform/set_device_name function in D-Link DIR-823X router microprogramming software allows a attacker to execute arbitrary commands.
The vulnerability of the /goform/setdevicename function in D-Link DIR-823X router microprogramming software is related to the lack of data cleaning measures at the control level when processing the mac parameter. Exploiting this vulnerability allows an attacker to execute arbitrary commands by...
The vulnerability of the /goform/delete_offline_device file in D-Link DIR-823X router microprogramming software allows a perpetrator to execute arbitrary commands.
The vulnerability of the /goform/deleteofflinedevice function in the microprogramming software for D-Link DIR-823X routers is related to the lack of measures taken at the control level when processing the delvalue parameter. Exploiting this vulnerability allows an attacker to execute arbitrary...
The vulnerability in the web interface of the script /htdocs/cgibin/hedwig.cgi, a microprogramming system for D-Link DIR-852 routers, allows a attacker to execute arbitrary commands.
The vulnerability of the web interface for controlling the D-Link DIR-852 router’s microprogramming system, located at /htdocs/cgibin/hedwig.cgi, is related to the lack of data cleaning measures at the control level. Exploiting this vulnerability allows an attacker to send arbitrary commands by...
CVE-2025-8406: Improper Limitation of a Pathname to a Restricted Directory
ZenML version 0.83.1 is affected by a path traversal vulnerability in the PathMaterializer class. The load function uses ispathwithindirectory to validate files during data.tar.gz extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file...