CVE-2024-37642

Summary (CVE-2024-37642): TRENDnet TEW-814DAP v1 with FW1.01B01 is affected by a command-injection vulnerability in the /formSystemCheck endpoint, exploitable via the ipv4_ping and ipv6_ping parameters. The vulnerability is labeled with a network attack vector, low authentication/privilege requir...

CVE-2024-36103

OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product...

CVE-2024-29972

UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2017-3506 Oracle WebLogic Server OS Command Injection Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose...

Tenda FH1206 mac parameter command injection vulnerability

The Tenda FH1206 is a wireless router from Tenda China. The Tenda FH1206 suffers from a command injection vulnerability, which originates from the mac parameter of ip/goform/WriteFacMac failing to correctly filter constructed command special characters, commands, etc. The vulnerability can be...

CVE-2024-35401

TOTOLINK CP900L v4.1.5cu.798B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function...

CVE-2024-35401

TOTOLINK CP900L v4.1.5cu.798B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function...

CVE-2024-35340

Tenda FH1206 V1.2.0.88155 was discovered to contain a command injection vulnerability via the cmdinput parameter at ip/goform/formexeCommand...

CVE-2024-35339

Tenda FH1206 V1.2.0.88155 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac...

TOTOLINK X5000R timeout parameter command injection vulnerability

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X5000R timeout parameter, which originates from the failure of the timeout parameter of /cgi-bin/cstecgi.cgi to properly filter constructed command special characters,...

TOTOLINK CPE CP450 setWebWlanIdx Method Command Injection Vulnerability

TOTOLINK CPE CP450 is an outdoor wireless client terminal device manufactured by China Gion Electronics TOTOLINK. The TOTOLINK CPE CP450 suffers from a command injection vulnerability that stems from the webWlanIdx parameter of the setWebWlanIdx method failing to correctly filter constructed...

TOTOLINK CPE CP450 CloudACMunualUpdate Method Command Injection Vulnerability

TOTOLINK CPE CP450 is an outdoor wireless client terminal device from China Gion Electronics TOTOLINK, which is mainly used to provide wireless broadband access services, especially for wireless network coverage in rural or remote areas. A command injection vulnerability exists in the TOTOLINK CP...

CVE-2024-3126

CVE-2024-3126 concerns the parisneo/lollms-webui project, specifically the bug in the Python file lollms_xtts.py and the function run_xtts_api_server. The issue stems from constructing an OS command with a Python f-string and passing xtts_base_url to subprocess.Popen without adequate input saniti...

CVE-2024-28136

A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service...

CVE-2024-32355

TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain a command injection vulnerability via the 'password' parameter in the setSSServer function...

CVE-2024-32353

CVE-2024-32353 affects TOTOLINK X5000R firmware version 9.1.0cu.2350_B20230313. A command injection exists in the setSSServer API at /cgi-bin/cstecgi.cgi via the port parameter, caused by inadequate input filtering of command characters. Impact is high (arbitrary command execution) with CVSSv3.1:...

PT-2024-24103 · Aruba · Aruba Central Communications Service

Name of the Vulnerable Software and Affected Versions: Aruba Central Communications service affected versions not specified Description: The issue is related to a command injection vulnerability in the Central Communications service. This vulnerability could lead to unauthenticated remote code...

Aruba Networks ArubaOS 和 InstantOS 安全漏洞

Aruba Networks ArubaOS and Aruba Networks InstantOS are both products of Aruba Networks, Inc.Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks, including Mobility Controllers and Mobility Access Switches. Aruba Networks InstantOS is an Arch Linux-based distribution...

PT-2024-24105 · Aruba · Aruba Access Point

Name of the Vulnerable Software and Affected Versions: Aruba Access Point affected versions not specified Description: The issue is related to a command injection vulnerability in the deauthentication service. This could lead to unauthenticated remote code execution by sending specially crafted...

GE HealthCare ultrasound devices 操作系统命令注入漏洞

GE General Electric Healthcare Ultrasound is a medical sonic detection device from General Electric GE. An operating system command injection vulnerability exists in GE HealthCare ultrasound devices, which stems from the presence of an operating system command injection vulnerability...