CVE-2024-51024

D-Link DIR823G 1.0.2B05 was discovered to contain a command injection vulnerability via the HostName parameter in the SetWanSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

D-Link DIR-823G 安全漏洞

The D-Link DIR-823G is a wireless router from China's AUO D-Link. The D-Link DIR-823G version 1.0.2B05 suffers from a command injection vulnerability that stems from the HostName parameter in the SetWanSettings function failing to properly filter constructed command special characters, commands,...

CVE-2024-51024

D-Link DIR823G 1.0.2B05 was discovered to contain a command injection vulnerability via the HostName parameter in the SetWanSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51024

The CVE-2024-51024 entry concerns the D-Link DIR-823G router, firmware 1.0.2B05. The SetWanSettings function’s HostName parameter can be exploited to inject arbitrary OS commands, enabling remote command execution. Affected component: SetWanSettings handling of HostName; root cause: lack of prope...

Cross Site Scripting(XSS)

librenms/librenms is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to insufficient input validation or sanitization of the "hostname" parameter in the "Device Dependencies" feature, allows attackers to inject arbitrary JavaScript, which can then be stored and executed in...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the hostname parameter, in the context of other users' sessions, by injecting...

PT-2024-7961 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.9.0 Description: A Stored Cross-Site Scripting XSS vulnerability in the "Device Dependencies" feature allows authenticated users to inject arbitrary JavaScript through the hostname parameter. This can lead to the...

TOTOLINK LR350 命令注入漏洞

TOTOLINK LR350 is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK LR350 version 9.3.5u.6369B20220309, which originates from the hostName parameter in the setWanCfg function of the /cgi-bin/cstecgi.cgi page that fails to correctly...

CVE-2024-37569

An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter sent by an authenticated...

CVE-2024-37569

An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter sent by an authenticated...

PT-2024-9269 · Mitel · Mitel 6869I

Name of the Vulnerable Software and Affected Versions: Mitel 6869i versions 4.5.0.41 and earlier Mitel 6869i versions 5.x through 5.0.0.1018 Description: A command injection issue exists in the hostname parameter taken in by the "provis.html" endpoint. The "provis.html" endpoint performs no...

CVE-2024-37569

CVE-2024-37569 affects Mitel 6869i SIP Phone (versions 4.5.0.41 and 5.x up to 5.0.0.1018). A command injection exists in the hostname parameter of the provis.html endpoint; the endpoint does not sanitize the hostname, writing it to disk and executing it during boot as part of shell commands. This...

CVE-2024-37569

An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter sent by an authenticated...

CVE-2024-37569

An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter sent by an authenticated...

Mitel 6869i SIP Security Vulnerability

Mitel 6869i SIP is a powerful and scalable desk phone from Mitel Canada. A security vulnerability exists in Mitel 6869i versions 4.5.0.41 and earlier, 5.0.0.1018 and earlier, which stems from the provis.html endpoint that does not clean up the hostname parameter, and can be exploited by an attack...

Input validation

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Hostname parameter at its web interface. A remote attacker could exploit this vulnerability by supplying specially crafted input to the parameter at the web interfac...

TOTOLINK A3300R setWanCfg Method Command Injection Vulnerability

The TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R version V17.0.0cu.557B20221024, which stems from the hostName parameter of the setWanCfg method failing to correctly filter the construct command specia...

CVE-2024-22942

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the hostName parameter in the setWanCfg function...

TOTOLINK LR1200GB setOpModeCfg Function OS Command Injection Vulnerability

The TOTOLINK LR1200GB is a wireless dual-band 4GLTE router from China's Gion Electronics TOTOLINK that supports 2.4GHz and 5GHz dual-band networks, and is primarily used to provide mobile broadband connectivity and Wi-Fi coverage. The TOTOLINK LR1200GB suffers from an operating system command...

TOTOLINK A3300R 安全漏洞

The TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R version V17.0.0cu.557B20221024, which stems from the hostName parameter of the setWanCfg method failing to correctly filter the construct command specia...