Advantech EKI-6333AC Capture Packages Command Execution

The vulnerability of the capturepackages function in multifunctional wireless access points of Advantech EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO is related to the lack of measures to neutralize special elements. Exploiting this vulnerability could allow a remote attacker to execute...

DrayTek Vigor 3900 doPPPo function Command Execution

The vulnerability of the doPPPo function in the mainfunction.cgi script of the DrayTek Vigor 3900 router software exists due to the failure to eliminate special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Advantech EKI-6333AC-2G Wireless Access Point Command Execution

The vulnerability of the microprogrammed software in multifunctional wireless access points Advantech EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO lies in the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary command...

CVE-2024-31976

EnGenius EWS356-FIR 1.1.30 and earlier devices allow a remote attacker to execute arbitrary OS commands via the Controller connectivity parameter...

PT-2024-24330

Name of the Vulnerable Software and Affected Versions EnGenius EWS356-FIR versions 1.1.30 and earlier Description The issue allows a remote attacker to execute arbitrary OS commands via the Controller connectivity parameter. This enables the attacker to gain unauthorized access and control over t...

EnGenius EWS356-FIT security vulnerabilities

The EnGenius EWS356-FIT is an indoor wireless access point from EnGenius. A security vulnerability exists in the EnGenius EWS356-FIT version 1.1.30 and prior versions. A remote attacker could exploit the vulnerability to execute arbitrary operating system commands via the controller connection...

Exploit for CVE-2023-38646

CVE-2023-38646-PoC-Metabase Proof-of-Concept script for exploi...

CVE-2024-50371

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The vulnerability can be exploited by remote...

D-Link DI-8200 Command Injection Vulnerability

The D-Link DI-8200 is an enterprise router from China-based AUO D-Link. The D-Link DI-8200 suffers from a command injection vulnerability that stems from a remote command execution vulnerability in the flag parameter and cmd parameter of the mspinfohtm function. No details of the vulnerability ar...

QuRouter OS Command Injection

The vulnerability of the QuRouter operating system for QNAP network devices is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Cortex XSOAR CommonScripts Arbitrary Command Execution

The vulnerability of the Cortex XSOAR CommonScripts package for security management, automation, and response involves a lack of data cleansing measures at the control level. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary commands...

LibreNMS Arbitrary Command Execution

The vulnerability of the LibreNMS network monitoring system is related to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Tenda AC6 Router Arbitrary Command Execution

The vulnerability of the formWriteFacMac function /goform/WriteFacMac of the Tenda AC6 router software lies in the lack of data cleaning at the control level when processing the mac parameter. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

mySCADA myPRO Runtime Command Injection

The vulnerability of the industrial process visualization and control systems mySCADA myPRO and mySCADA myPRO Manager lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrar...

CVE-2024-11666: Insufficient Verification of Data Authenticity

Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users suitably positioned on the network between an...

Malicious code in codeql-extractor-iac-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3f77f847f2c7d09571ef2516734c1d483d434e0980f32c21967900b8d28dd4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for OS Command Injection in Zimbra Collaboration

CVE-2024-45519 CVE-2024-45519 is a high-risk vulnerability in...

D-LINK DI-8400 Remote Command Execution Vulnerability

The D-LINK DI-8400 is an American D-Link router device for home and small business network connectivity. Multiple remote command execution vulnerabilities exist in the mspinfohtm function in the D-LINK DI-8400 version v16.07.26A1 via the flag and cmd parameters. A remote attacker can exploit this...

CVE-2024-48860: Improper Neutralization of Special Elements used in a Command

An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to execute commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.3.103 and later...

NETGEAR R8500 Ether.cgi Command Execution

The vulnerability of the ether.cgi script in NETGEAR R8500 router microprogramming software relates to the failure to take measures to neutralize special elements used in the operating system’s processing of the wangateway parameter. Exploiting this vulnerability allows a remote attacker to execu...