GitHub Enterprise Server Command Injection Vulnerability

GitHub Enterprise Server is a U.S. GitHub open source application. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server that stems from the presence of...

CVE-2024-0165

Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svcacldbdump utility. An authenticated attacker could potentially exploit this vulnerability, leading to execution of arbitrary operating system commands with root privileges...

CVE-2024-22222

Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability within its svcudoctor utility. An authenticated malicious user with local access could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, wi...

CVE-2023-42664

A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTT...

CVE-2024-22107

An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method systemSettingsDnsDataAction at /opt/webapp/src/AppBundle/Controller/React/SystemSettingsController.php is vulnerable to command injection via the /old/react/v1/api/system/dns/data endpoint. An authenticated attacker can...

CVE-2023-47566 QTS, QuTS hero, QuTScloud

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645...

TOTOLINK A3300R setWiFiAclRules method command injection vulnerability

TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R version V17.0.0cu.557B20221024, which stems from the desc parameter of the setWiFiAclRules method failing to correctly filter the construct command special...

CVE-2024-24325

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParentalRules function...

CVE-2024-24332

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function...

CVE-2024-24327

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIpv6Cfg function...

PT-2024-20363 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: The issue is related to a command injection vulnerability. This vulnerability can be exploited via the port or enable parameters in the setRemoteCfg function. Recommendations: For...

TRENDnet TEW-815DAP Command Injection Vulnerability

The TRENDnet TEW-815DAP is a wireless access point from Trendnet, Inc. A command injection vulnerability exists in the TRENDnet TEW-815DAP version 1.0.2.0, which stems from the fact that incorrect operation of the parameters NtpDstStart/NtpDstEnd can lead to command injection...

PT-2024-5052 · Netis Systems · Netis Systems Mw5360

Name of the Vulnerable Software and Affected Versions: NETIS SYSTEMS MW5360 version 1.0.1.3031 Description: The issue is related to a command injection vulnerability via the password parameter on the login page. This vulnerability may allow a remote attacker to execute arbitrary commands...

CVE-2024-22663

The CVE-2024-22663 entry documents a command injection vulnerability in TOTOLINK A3700R devices, triggered via the setOpModeCfg function. Affected software is TOTOLINK A3700R with firmware version 9.1.2u.6165 (build 20211012). The issue allows arbitrary command execution, with high impact to conf...

Command Injection Vulnerability in DIR-822+ V1.0.2 of AUO Electronic Equipment (Shanghai) Co.

DIR-822 is a wireless router from D-Link, a Chinese company. A command injection vulnerability exists in the AUO Electronic Devices Shanghai Co. DIR-822+ version V1.0.2, which stems from the SetStaticRouteSettings function failing to correctly filter constructor command special characters,...

TOTOLINK A3700R NTPSyncWithHost Method Command Injection Vulnerability

The TOTOLINK A3700R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in TOTOLINK A3700R v9.1.2u.5822B20200513, which stems from the NTPSyncWithHost method failing to properly filter construct command special characters, commands, and so on. An...

TOTOLINK A3300R setNtpCfg Method Command Injection Vulnerability

TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R version V17.0.0cu.557B20221024, which stems from the tz parameter of the setNtpCfg method failing to correctly filter construct command special characters,...

MGASA-2024-0010 Updated openssh packages fix security vulnerabilities

The updated packages fix security vulnerabilities: The PKCS11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. CVE-2023-38408 Prefix Truncation Attacks in SSH...

DEBIAN-CVE-2023-51698

Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This vulnerability gives the attacker immediate access to the target system when the target user opens a crafted document or clicks on a crafted link/URL using a maliciously crafted CB...

CVE-2023-51698

Atril (the Atril document viewer) is vulnerable to a critical Command Injection vulnerability (CVE-2023-51698). A crafted CBT document packaged as a TAR archive can allow an attacker to execute arbitrary commands when opened or when a user clicks a crafted link, potentially giving immediate acces...