169 matches found
Xcomic 操作系统命令注入漏洞
Xcomic is a comic management script by the individual developer Michael Huynh. An operating system command injection vulnerability exists in Xcomic version 0.8.2 and earlier, which stems from the fact that manipulation of the cmd parameter can lead to operating system command injection...
CVE-2024-41319
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd function...
flatpak: sandbox escape via RequestBackground portal
A flaw was found in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. Normally, the "--command" argument of "flatpak run" expects being given a command to run in the specified Flatpak app, along with optional arguments. However, it is possible to...
Slackware: Security Advisory (SSA:2024-103-01)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Telesquare TLR-2005Ksh 安全漏洞
The Telesquare TLR-2005Ksh is a wireless router from the South Korean company Telesquare. A security vulnerability exists in Telesquare TLR-2005Ksh version 1.0.0 and 1.1.4, which originated from a vulnerability that allows an attacker to run arbitrary system commands via the Cmd parameter...
UBUNTU-CVE-2021-47079
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ideapad-laptop: fix a NULL pointer dereference The third parameter of dytccqlcommand should not be NULL since it will be dereferenced immediately...
TOTOLINK N200RE command parameter buffer overflow vulnerability
The TOTOLINK N200RE is a wireless router for the SOHO market. The TOTOLINK N200RE suffers from a buffer overflow vulnerability that originates from a stack-based buffer overflow in the command parameter of the setDiagnosisCfg function of /cgi-bin/cstecgi.cgi. No detailed vulnerability details are...
PT-2024-15962 · Unknown · Asterisk-Cli +1
Name of the Vulnerable Software and Affected Versions: Issabel PBX version 4.0.0 Description: A critical issue affects the processing of the file /index.php?menu=asterisk cli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be...
CVE-2023-43455
An issue in TOTOLINK X6000R V9.4.0cu.652B20230116 and V9.4.0cu.852B20230719 allows a remote attacker to execute arbitrary code via the command parameter of the setting/setTracerouteCfg component...
CVE-2023-43455
CVE-2023-43455 affects TOTOLINK X6000R versions V9.4.0cu.652_B20230116 through V9.4.0cu.852_B20230719.** The issue allows a remote attacker to execute arbitrary code via the command parameter of the setting/setTracerouteCfg component.** Root cause details are not expanded beyond this parameter ha...
PT-2023-6552 · Totolink · Totolink X5000R
Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R versions V9.1.0u.6118 B20201102 through V9.1.0u.6369 B20230113 Description: The issue concerns a command insertion vulnerability in the setting/setTracerouteCfg component of the TOTOLINK X5000R router's firmware. This...
Aigital Wireless-N Repeater Mini_Router 安全漏洞
Aigital Wireless-N Repeater Mini-Router is a wireless router repeater from Aigital. A security vulnerability exists in Aigital Wireless-N Repeater MiniRouter version v0.131229, which stems from the discovery of a Remote Code Execution RCE vulnerability via the sysCmd parameter in the formSysCmd...
CVE-2022-45030
A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= this may interact with secure-file-priv...
Korenix Technology Korenix JetWave 命令注入漏洞
Korenix Technology Korenix JetWave is a family of wireless access points from Korenix Technology. A security vulnerability exists in Korenix Technology Korenix JetWave 4200 Series version 1.3.0, JetWave 3000 Series version 1.6.0. An attacker can exploit the vulnerability to execute commands as ro...
The vulnerability of the D-Link DIR-610 network device’s microprogramming software arises from the lack of measures taken to neutralize the special elements used in the operating system commands. This vulnerability allows a hacker to execute arbitrary commands.
The vulnerability of the D-Link DIR-610 network device exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the cmd parameter in the...
PT-2022-26882 · Apache · Apache Kylin
Name of the Vulnerable Software and Affected Versions: Apache Kylin affected versions not specified Description: The issue arises from a fix that uses a blacklist to filter user input commands, but this approach is at risk of being bypassed. An attacker can potentially control the command by...
Event Registration System 代码问题漏洞
Event Registration System is an event registration system with QR codes by Carlo Montero Personal Developer. A security vulnerability exists in the Event Registration System version 1.0, which stems from an incorrect manipulation of the parameter cmd leading to unrestricted file uploads...
CVE-2022-41523
TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain an authenticated stack overflow via the command parameter in the setTracerouteCfg function...
