CVE-2024-35518

Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in geniefix2.cgi via the wandns1pri parameter...

CVE-2024-35518

Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in geniefix2.cgi via the wandns1pri parameter...

DrayTek Vigor 3900 安全漏洞

DrayTek Vigor 3900 is a high performance router for enterprise networks from China DrayTek. A security vulnerability exists in the DrayTek Vigor 3900 version 1.5.1.3. An attacker can exploit this vulnerability to inject malicious commands into mainfunction.cgi and execute arbitrary commands by...

Unspecified Vulnerability in NETGEAR EX3700 (CNVD-2024-41044)

NETGEAR EX3700 is a wireless network signal extender from NETGEAR. A security vulnerability exists in the NETGEAR EX3700 prior to version 1.0.0.98, which originates from an authenticated command injection of the apmode parameter in workingmode.cgi. No details of the vulnerability are available at...

CVE-2024-35518

CVE-2024-35518 affects Netgear EX6120 v1.0.0.68. The vulnerability is a command injection in the genie_fix2.cgi script via the wan_dns1_pri parameter, enabling arbitrary command execution. Public sources (CNVD/CNNVD/NVD) corroborate the flaw in the same version. CVSS details in the NVD/CVE record...

CVE-2024-35518

Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in geniefix2.cgi via the wandns1pri parameter...

CVE-2024-35522

Netgear EX3700 ' AC750 WiFi Range Extender Essentials Edition before 1.0.0.98 contains an authenticated command injection in operatingmode.cgi via the apmode parameter with ap24gmanual set to 1 and ap24gmanualsec set to NotNone...

CVE-2024-35522

Netgear EX3700 ' AC750 WiFi Range Extender Essentials Edition before 1.0.0.98 contains an authenticated command injection in operatingmode.cgi via the apmode parameter with ap24gmanual set to 1 and ap24gmanualsec set to NotNone...

NETGEAR EX3700 安全漏洞

NETGEAR EX3700 is a wireless network signal extender from NETGEAR. A security vulnerability exists in the NETGEAR EX3700 prior to version 1.0.0.98, which originates from an authenticated command injection of the apmode parameter in workingmode.cgi. No details of the vulnerability are available at...

CVE-2023-46586

cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 before 1.0 lacks '\0' termination of the path for CGI scripts because strncpy is misused...

Weborf 安全漏洞

Weborf is a lightweight web server by the individual developer of ltworf. A security vulnerability exists in Weborf versions prior to 1.0, which stems from a misuse of strncpy and a missing terminator in cgi.c for CGI script paths...

CVE-2023-46586

cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 before 1.0 lacks '\0' termination of the path for CGI scripts because strncpy is misused...

CVE-2023-46586

cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 before 1.0 lacks '\0' termination of the path for CGI scripts because strncpy is misused...

CVE-2023-46586

cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 before 1.0 lacks '\0' termination of the path for CGI scripts because strncpy is misused...

The vulnerability of the component cgi-bin/mainfunction.cgi/cvmcfgupload in the microprogramming software for DrayTek Vigor allows a hacker to execute arbitrary code.

The vulnerability of the cgi-bin/mainfunction.cgi/cvmcfgupload component of DrayTek Vigor routing software exists due to the failure to eliminate special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

DEBIAN-CVE-2024-8927

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP...

AZL-50164 CVE-2024-8927 affecting package php for versions less than 8.3.12-1

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP...

AZL-50132 CVE-2024-8927 affecting package php for versions less than 8.1.30-1

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP...

CVE-2024-8927 cgi.force_redirect configuration is bypassable due to the environment variable collision

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP...

CVE-2024-8927 cgi.force_redirect configuration is bypassable due to the environment variable collision

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP...