CVE-2023-39367

An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Tenda W30E 安全漏洞

Tenda W30E is an enterprise-grade wireless router designed for SOHO, small and micro business offices and small store networking, supporting Wi-Fi 6 technology. The Tenda W30E suffers from a command injection vulnerability that stems from the cmdinput parameter of the formexeCommand method failin...

Tenda AC7 安全漏洞

Tenda AC7 is a 1200M dual-band wireless router designed for large households by Tenda Technology, which adopts the 802.11ac standard and supports dual-band concurrent transmission with a wireless rate of up to 1167Mbps. Tenda AC7 suffers from a command injection vulnerability that stems from the...

Tenda FH1203 安全漏洞

Tenda FH1203 is a dual-band wireless router from Tenda China, mainly used for home network coverage. The Tenda FH1203 suffers from a command injection vulnerability that stems from the cmdinput parameter of the formexeCommand method failing to properly filter construct command special characters,...

The software of the centralized backup and disaster recovery system of Dell PowerProtect Data Manager is vulnerable due to the lack of measures to neutralize special elements used in the operating system command set. This vulnerability allows a malicious actor to execute arbitrary commands on the basic operating system.

The software of the centralized backup and disaster recovery system Dell PowerProtect Data Manager is vulnerable because measures are not taken to neutralize the special elements used in the operating system command set. Exploiting this vulnerability could allow a malicious actor to execute any...

nginxWebUI OS Command Injection Vulnerability

nginxWebUI is an nginx web configuration tool. An operating system command injection vulnerability exists in nginxWebUI, which stems from the file parameter of the /adminPage/main/upload file failing to properly filter constructed command special characters, commands, and so on. An attacker can...

CVE-2023-33806

Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands...

CVE-2024-30220

Command injection vulnerability in PLANEX COMMUNICATIONS wireless LAN routers allows a network-adjacent unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port. Note that MZK-MF300N is no longer supported, therefore the update for this...

CVE-2024-30220

CVE-2024-30220 : Command injection in PLANEX COMMUNICATIONS wireless LAN router models (notably MZK-MF300N). An unauthenticated, network-adjacent attacker can trigger arbitrary commands by sending a crafted request to a specific port. The MZK-MF300N is no longer supported, and vendor updates are ...

Hikvision Interactive Tablet DS-D5B86RB/B 安全漏洞

The Hikvision Interactive Tablet DS-D5B86RB/B is a 4K interactive display from Hikvision China. A security vulnerability exists in Hikvision Interactive Tablet DS-D5B86RB/B version V2.3.0 build220119, which stems from the presence of an insecure default configuration that allows an attacker to...

PT-2024-12442 · Hikvision · Hikvision Interactive Tablet Ds-D5B86Rb/B

Name of the Vulnerable Software and Affected Versions: Hikvision Interactive Tablet DS-D5B86RB/B version 2.3.0 build220119 Description: Insecure default configurations in the Hikvision Interactive Tablet allow attackers to execute arbitrary commands. Recommendations: For version 2.3.0 build220119...

Aim Code Injection Vulnerability

Aim is an easy-to-use and high-performance open source experiment tracker from the United States. Aim suffers from a code injection vulnerability. The vulnerability stems from the application failing to properly filter special elements of constructed code segments. An attacker could exploit the...

nginxWebUI 操作系统命令注入漏洞

nginxWebUI is an nginx web configuration tool. An operating system command injection vulnerability exists in nginxWebUI, which stems from the file parameter of the /adminPage/main/upload file failing to properly filter constructed command special characters, commands, and so on. An attacker can...

CVE-2024-29454

CVE-2024-29454 is rejected/not used; this candidate was withdrawn and does not represent an active vulnerability entry.

Form Tools 安全漏洞

Form Tools is an open source code base for Form Tools scripts, modules, themes and APIs. A security vulnerability exists in Form Tools version 3.1.1 that originates from allowing an attacker to run arbitrary commands through the Group Name field under the Add Form section of the application...

TP-LINK AC1350 and N300 Command Injection Vulnerability

The TP-LINK AC1350/N300 is a router from China P&L TP-LINK. The TP-LINK AC1350 and TP-LINK N300 suffer from a command injection vulnerability that stems from the tddpd enabletestmode function failing to correctly filter constructed command special characters, commands, and so on. An attacker can...

CVE-2024-29269

An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter...

Multiple vulnerabilities in a-blog cms

Overview a-blog cms provided by appleple inc. contains multiple vulnerabilities listed below. Stored cross-site scripting vulnerability in Entry editing pages CWE-79 - CVE-2024-30419 Server-side request forgery CWE-918 - CVE-2024-30420 Directory traversal CWE-22 - CVE-2024-31394 Stored cross-site...

csmock 安全漏洞

csmock is a tool automation approach to scanning SRPMs through static analysis tools by csutils open source. A security vulnerability exists in csmock. An attacker exploited the vulnerability to execute arbitrary commands against OSH staff...

Aim 代码注入漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from the United States. Aim suffers from a code injection vulnerability. The vulnerability stems from the application failing to properly filter special elements of constructed code segments. An attacker could exploit the...