PT-2024-7029 · D Link · D-Link Dir-878 +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-882 versions FW130B06 D-Link DIR-878 versions FW130B08 Description: A command injection issue exists in the SetMACFilters2 function due to insufficient neutralization of special elements used in an OS command. This allows attackers...

PT-2024-6501

Name of the Vulnerable Software and Affected Versions CUPS cups-browsed versions 2.0.1 and earlier Description The cups-browsed component of the Common Unix Printing System CUPS, which handles network printer discovery, binds to INADDR ANY:631. This configuration causes the service to trust packe...

CVE-2024-46627: Improper Access Control

Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests...

PT-2024-31207 · Gigastone · Gigastone Tr1 Travel Router R101

Name of the Vulnerable Software and Affected Versions: Gigastone TR1 Travel Router R101 version 1.0.2 Description: The issue allows an authenticated attacker to execute arbitrary commands on the device by sending a crafted HTTP request to the ssid parameter in the request. This enables the attack...

DedeCMS Command Injection Vulnerability

DedeCMS Dream Weaving Content Management System is a PHP-based open source content management system CMS. The system has content publishing, content management, content editing and content retrieval functions. DedeCMS has a command injection vulnerability that stems from the articlestringmix.php...

Zyxel NAS326/NAS542 Command Injection

The vulnerability of the microprogrammed network storage devices Zyxel NAS326 and Zyxel NAS542 is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by...

D-Link DI-8300 Router Arbitrary Command Execution

The vulnerability of the mspinfohtm function in D-Link DI-8300 router microprogramming software is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using the GET request...

OS Command Execution

github.com/chaosblade-io/chaosblade is vulnerable to OS Command Execution. The vulnerability is due to the lack of authentication when using the cmd parameter in the exec.CommandContext function in server mode. It allows an attacker to execute arbitrary OS commands on the server without...

CVE-2024-39842

The Centreon monitoring tool is vulnerable to SQL injection in version 24.04.2 . The root cause is the lack of proper validation for user-supplied strings before they are used to construct SQL queries, specifically within the updateContactServiceCommands_MC , updateContactHostCommands_MC , and up...

CVE-2024-39843

A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via create user form inputs...

CVE-2024-39843

A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via create user form inputs...

Centreon security vulnerabilities

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . The product provides monitoring capabilities for network, system and application resources. A security vulnerability exists in Centreon version 24.04.2. An attacker can exploit this...

CVE-2024-39842

A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via user massive changes inputs...

Multiple vulnerabilities in TAKENAKA ENGINEERING digital video recorders

Overview Multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. contain multiple vulnerabilities listed below. Improper authentication CWE-287 - CVE-2024-41929 OS command injection CWE-78 - CVE-2024-43778 Hidden functionality CWE-912 - CVE-2024-47001 Yoshiki Mori, Ushimaru...

Execution With Unnecessary Privileges

github.com/openshift/builder is vulnerable to Execution With Unnecessary Privileges. The vulnerability is caused due to improper validation of the spec.source.secrets.secret.destinationDir attribute, allowing path traversal that enables a malicious user to override executable files inside the...

VulnCheck KEV: CVE-2024-30891

A command injection vulnerability exists in /goform/exeCommand in Tenda AC18 v15.03.05.05, which allows attackers to construct cmdinput parameters for arbitrary command execution...

CVE-2024-41929

Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings...

VulnCheck KEV: CVE-2024-29269

An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter...

Ubuntu 14.04 LTS : OpenSSL vulnerabilities (USN-7018-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7018-1 advisory. Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky discovered that certain Diffie- Hellman ciphersuites in the TLS specification and...

CVE-2024-8957

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntpaddr configuration value which may lead to arbitrary command execution when ntpclient is started. When chained with CVE-2024-8956, a remote and...