CVE-2024-28728: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to obtain sensitive information via a crafted payload to the WiFi SSID Name field...

PT-2024-22545

Name of the Vulnerable Software and Affected Versions DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 version 1.34ME Dlink DWR 5G CPE DWR-2000M version 1.34ME Description The issue allows a local attacker to obtain sensitive information via the Port forwarding option. This is related to a Cross Site...

CVE-2024-28728

The DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 (version DWR-2000M 1.34ME ) and Dlink DWR 5G CPE (version DWR-2000M 1.34ME ) are vulnerable to a Cross Site Scripting (XSS) vulnerability. A local attacker can exploit this by sending a crafted payload to the WiFi SSID Name field to obtain sensitive i...

CVE-2024-28729

An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to execute arbitrary code via a crafted request...

CVE-2024-28731: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to obtain sensitive information via the Port forwarding option...

CVE-2024-28726: Improper Neutralization of Special Elements used in a Command

An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to execute arbitrary code via a crafted payload to the Diagnostics function...

CVE-2024-28730: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to obtain sensitive information via the file upload feature of the VPN configuration module...

CVE-2024-28726

An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to execute arbitrary code via a crafted payload to the Diagnostics function...

CVE-2024-28729: Improper Neutralization of Special Elements used in a Command

An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to execute arbitrary code via a crafted request...

CVE-2024-28726

The DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE (specifically version DWR-2000M_1.34ME ) are vulnerable to a command injection flaw. A local attacker can execute arbitrary code by sending a crafted payload to the Diagnostics function . The root cause is identified as a lack of ...

Tianyu CPE Router CommonCPExCPETS Command Execution Vulnerability

Tianyu CPE Router is a wireless router from China Tianyu Tianyu. A command execution vulnerability exists in the Tianyu CPE Router CommonCPExCPETS, which can be exploited by an attacker to execute arbitrary commands on the system...

AlmaLinux 9 : python3.12 (ALSA-2024:8447)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:8447 advisory. python: cpython: tarfile: ReDos via excessive backtracking while parsing header values CVE-2024-6232 Tenable has extracted the preceding description block directly...

NuGet Package 'Betalgo.OpenAI' Detection

The remote host has a 'Betalgo.OpenAI' with a Verified NuGet package status and is installed on the remote host. Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...

CVE-2024-48440

Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command injection vulnerability via the component atcommand.asp...

CVE-2024-48441

Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETSv3.2.468.11.04P4 was discovered to contain a command injection vulnerability via the component atcommand.asp...

CVE-2024-48442

Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 allows attackers to access the SSH protocol without authentication...

CVE-2024-48440

Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command injection vulnerability via the component atcommand.asp...

CVE-2024-48440

The Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA (firmware version RG500UEAABxCOMSLICv3.2.2543.12.18 ) is susceptible to a command injection vulnerability. The flaw exists within the at_command.asp component, likely due to the improper neutralization of special elements u...

CVE-2024-48441

The Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router (specifically version CommonCPExCPETS_v3.2.468.11.04_P4 ) is vulnerable to a command injection vulnerability via the at_command.asp component. An attacker can exploit this flaw to execute arbitrary commands on the system. As a remed...

PT-2024-33111

Name of the Vulnerable Software and Affected Versions Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLIC version 3.2.2543.12.18 Description A command injection issue was found in the component at command.asp. Recommendations For version 3.2.2543.12.18, consid...