18168 matches found
D-Link DIR-878 OS Command Injection Vulnerability (CNVD-2022-14785)
D-Link DIR-878 is a wireless router from D-Link Taiwan, China. The D-Link DIR-878 is vulnerable to operating system command injection, which can be exploited by attackers to execute arbitrary commands via crafted HNAP1 POST requests...
CVE-2022-25134
A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...
CVE-2022-25130
A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...
CVE-2022-25131
A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...
CVE-2022-25136
A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...
Command injection
A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...
Command injection
A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...
CVE-2022-25137
A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...
CVE-2022-25136
A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...
CVE-2022-21143
CVE-2022-21143 is an OS Command Injection affecting Airspan/Mimosa MMP family. Affected: MMP prior to v1.0.3; PTP C-series prior to v2.8.6.1; PTMP C-series and A5x prior to v2.5.4.1. Root cause: improper sanitization of user input across multiple locations, enabling an attacker to inject arbitrar...
[SECURITY] [DLA 2926-1] zsh security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-2926-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort February 18, 2022 https://wiki.debian.org/LTS -...
Tenda G1 and G3 Command Injection Vulnerability (CNVD-2022-16178)
The Tenda G1 and G3 are routers from the Chinese company Tenda. A command injection vulnerability exists in the Tenda G1 and G3, which can be exploited to execute arbitrary commands via the pppoeServerIP, pppoeServerStartIP, and pppoeServerEndIP parameters...
Security Updates for Microsoft SharePoint Server 2019 (December 2021)
The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A session spoofing vulnerability exists. An attacker can exploit this to perform actions with the privileges of another user. CVE-2021-42320,...
Remote code execution
Remote Code Execution RCE vulnerability exists in D-Link Router DIR-846 DIR846A1FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use this vulnerability to use "\ " or backticks to bypass the shell metacharacters in the ssid0 or ssid1 parameters to execute arbitrary commands.Th...
SQL Injection
com.mxpio:jeecg-boot-module-system is vulnerable to SQL injection attacks. An attacker is able to execute arbitrary SQL commands via id and realname parameters in queryUserByDepId function...
The vulnerability of the ufshcd_eh_device_reset_handler function (ufshcd.c) in the Android operating system allows a hacker to execute arbitrary commands and gain access to information.
The vulnerability of the ufshcdehdeviceresethandler function ufshcd.c in the Android operating system’s kernel is related to reading data beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary commands and gain access to sensitive information...
Debian: Security Advisory (DSA-5078-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PhpUploader SQL注入漏洞
PhpUploader is a simple Php uploader by Shimosyan Personal Developer in Japan. PhpUploader suffers from a SQL injection vulnerability that stems from insufficient processing of user-supplied data. A remote attacker can exploit the vulnerability by sending specially designed requests to an affecte...
Security Bulletin: Vulnerabilities in Bash affect ProtecTIER (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)
Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by ProtecTIER. Vulnerability Details CVE-ID : CVE-2014-6271 DESCRIPTION :...
