CVE-2023-35964

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression...

CVE-2023-35964

GTKWave 3.3.115 contains decompression flaws in vcd2lxt that can lead to arbitrary code execution when a user opens a crafted wave file. CVE-2023-35964, rated HIGH (CVSS 7.8), requires local access and user interaction. The issue affects GTKWave, with Debian advisories noting fixes in 3.3.118+ (D...

CVE-2023-35962

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression...

CVE-2023-35961

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression...

CVE-2023-35959

CVE-2023-35959 affects GTKWave (waveform viewer); multiple OS command injection vulnerabilities exist in the .ghw decompression path. An attacker could achieve arbitrary command execution by the user opening a specially crafted .ghw file; local attacker would need to run GTKWave with the affected...

CVE-2023-35962

GTKWAVE 3.3.x contains multiple OS command injection vulnerabilities in the decompression path of the vcd2vzt utility. GTKWave versions up to 3.3.115 are affected; exploitation would occur when a victim opens a crafted VCD/wave file, potentially allowing arbitrary code execution due to decompress...

CVE-2023-35961

CVE-2023-35961 affects GTKWave’s decompression path (vcd_recorder_main) and allows multiple OS command injections when a malformed VCD/Wave file is opened. The advisory chain confirms GTKWave 3.3.115 is vulnerable and lists fixes in upstream upgrades, with Debian/DSA-5653 and DLA-3785 advising to...

CVE-2024-0299

A vulnerability was found in Totolink N200RE 9.3.5u.6139B20201216. It has been declared as critical. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be launched...

CVE-2024-0299 Totolink N200RE cstecgi.cgi setTracerouteCfg os command injection

A vulnerability was found in Totolink N200RE 9.3.5u.6139B20201216. It has been declared as critical. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be launched...

CVE-2024-0299

Totolink N200RE 9.3.5u.6139_B20201216 is affected by a remote OS command injection in the setTracerouteCfg function of /cgi-bin/cstecgi.cgi. Exploitation targets the command parameter; the vulnerability is publicly disclosed and can be triggered remotely. Public docs do not reveal a vendor patch ...

CVE-2024-0298

A vulnerability was found in Totolink N200RE 9.3.5u.6139B20201216. It has been classified as critical. Affected is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to launch the attack remotely. The...

Command injection

A vulnerability was found in Totolink N200RE 9.3.5u.6139B20201216 and classified as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack may be initiated remotely. The...

CVE-2024-0298 Totolink N200RE cstecgi.cgi setDiagnosisCfg os command injection

A vulnerability was found in Totolink N200RE 9.3.5u.6139B20201216. It has been classified as critical. Affected is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to launch the attack remotely. The...

CVE-2024-0297

Totolink N200RE (firmware 9.3.5u.6139_B20201216) has a vulnerability in the UploadFirmwareFile function at /cgi-bin/cstecgi.cgi. The FileName parameter manipulation leads to OS command injection. Remote exploitation is possible and public PoCs/exploits have been disclosed. Multiple sources confir...

CVE-2024-0297 Totolink N200RE cstecgi.cgi UploadFirmwareFile os command injection

A vulnerability was found in Totolink N200RE 9.3.5u.6139B20201216 and classified as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack may be initiated remotely. The...

CVE-2024-0295 Totolink LR1200GB cstecgi.cgi setWanCfg os command injection

A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619B20230130. This affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to initiate the attack remotely. Th...

CVE-2024-0295

The CVE-2024-0295 entry affects Totolink LR1200GB, specifically the function setWanCfg in /cgi-bin/cstecgi.cgi. The vulnerability arises from insufficient input validation of the hostName argument, enabling os command injection and remote exploitation. Public exploit details are available and the...

CVE-2024-0295 Totolink LR1200GB cstecgi.cgi setWanCfg os command injection

A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619B20230130. This affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to initiate the attack remotely. Th...

CVE-2024-0294

A vulnerability, which was classified as critical, has been found in Totolink LR1200GB 9.1.0u.6619B20230130. Affected by this issue is the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to os command injection. The attack may be launched remotely. T...

CVE-2024-0293

A vulnerability classified as critical was found in Totolink LR1200GB 9.1.0u.6619B20230130. Affected by this vulnerability is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack can be launched remotel...