CVE-2023-52032

TOTOlink EX1200T V4.1.2cu.5232B20210713 was discovered to contain a remote command execution RCE vulnerability via the "main" function...

PT-2024-14366 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOlink EX1200T version 4.1.2cu.5232 B20210713 Description: The issue is related to a remote command execution RCE vulnerability. It is exploited via the main function. Recommendations: For TOTOlink EX1200T version 4.1.2cu.5232 B20210713,...

CVE-2023-52028

CVE-2023-52028 affects TOTOLINK A3700R devices (v9.1.2u.5822_B20200513). The vulnerability is a remote command execution via the setTracerouteCfg function, stemming from insufficient filtering of constructed command characters, allowing an attacker to execute arbitrary commands remotely. Public d...

CVE-2023-52027

CVE-2023-52027 affects TOTOLINK A3700R (v9.1.2u.5822_B20200513). The NTPSyncWithHost function allows remote command execution due to insufficient filtering of constructed commands, enabling arbitrary commands to be run by an attacker with network access. Public sources corroborate RCE via NTPSync...

CVE-2023-52030

The CVE-2023-52030 issue affects TOTOLINK A3700R, specifically v9.1.2u.5822_B20200513, where the setOpModeCfg function permits remote command execution (RCE). Public sources describe a command-injection path through setOpModeCfg, enabling arbitrary command execution on the device. The vulnerabili...

CVE-2023-52028

TOTOlink A3700R v9.1.2u.5822B20200513 was discovered to contain a remote command execution RCE vulnerability via the setTracerouteCfg function...

CVE-2023-52030

TOTOlink A3700R v9.1.2u.5822B20200513 was discovered to contain a remote command execution RCE vulnerability via the setOpModeCfg function...

Zyxel GS1900 series Switch Privilege Escalation

The vulnerability of the microprogrammed software of Zyxel GS1900 series switches is related to insecure management of privileges. Exploiting this vulnerability allows an attacker to execute arbitrary commands and elevate their privileges to the root level via SSH...

PT-2024-14364 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOlink A3700R version 9.1.2u.5822 B20200513 Description: The issue is related to a remote command execution RCE vulnerability. It can be exploited via the setOpModeCfg function. Recommendations: For TOTOlink A3700R version 9.1.2u.5822...

QNAP QVR Command Injection

The vulnerability of the QNAP QVR video surveillance system exists due to the failure to take measures to neutralize certain elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2023-50982

Stud.IP 5.x through 5.3.3 allows XSS with resultant upload of executable files, because uploadaction and editaction in AdminSmileysController do not check the file extension. This leads to remote code execution with the privileges of the www-data user. The fixed versions are 5.3.4, 5.2.6, 5.1.7,...

CVE-2023-41288 Video Station

An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 2023/11/23 and later...

QNAP Systems Video Station Operating System Command Injection Vulnerability

QNAP Systems Video Station is a video management and playback application from QNAP Systems. An operating system command injection vulnerability exists in QNAP Systems Video Station prior to version 5.7.2 2023/11/23 , which stems from the presence of an operating system command injection...

TOTOLINK A7100RU Router Command Execution

The vulnerability of the main function in the csteccgi.cgi script /cgi-bin/cstecgi.cgi?action=login of the TOTOLINK A7100RU router software is related to the output of operations that go beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

CyberPanel < 2.3.8 Remote Command Execution

CyberPanel version prior to 2.3.8 are affected by a vulnerability allowing an unauthenticated attacker to execute commands on the remote machine via a specially forged request. No source data...

CVE-2024-21623: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient "Analysis - SonarCloud" workflow is vulnerable to an expression injection in Actions, allowing an attacker to run commands remotely on the runner, leak secrets, and...

OTCLient Injection Vulnerability

OTCLient is a replacement tibia client for otserv, written in C++20 and Lua, and is made on a modular system that uses lua scripting to implement in-game interfaces and features. OTCLient suffers from an injection vulnerability. An attacker could use this vulnerability to remotely run commands on...

Proscend M330-w Command Injection

The vulnerability of Proscend M330-w, M330-W5, M350-5G, M350-W5G, M350-6, M350-W6, M301-G, M301-GW, and ICR 111WG microprogrammed software in industrial routers is related to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this...

Tenda Telnet Arbitrary Command Execution

The vulnerability of the TendaTelnet function in the microprogramming software of the Tenda M3 network access controller exists due to the failure to take measures to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to...

downFiles Command Execution

The vulnerability of the downFiles function in the microprogramming software for wireless access point controllers Ruijie WS6008 and WS6108 is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow a malicious actor to execute arbitrary...