77 matches found
Waitress 安全漏洞
Waitress is a production-quality, pure Python WSGI server from the Pylons project. A security vulnerability existed prior to Waitress version 3.0.1, which stemmed from the fact that if a remote client closed a connection before waitress called getpeername, waitress would fail to clean up the...
python-gevent: privilege escalation via a crafted script to the WSGIServer component
A flaw was found in python-event, which could allow a remote attacker to gain elevated privileges on the system, caused by a flaw in the WSGIServer component. By using a specially crafted script, an attacker can gain elevated privileges...
The vulnerability of the WSGI-server microprogramming software for Network Attached Storage devices NAS326 and NAS542 allows a hacker to inject commands into the basic operating system.
The vulnerability of the WSGI-server microprogramming system for Network Attached Storage devices NAS326 and NAS542 is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows an attacker to inject commands...
The vulnerability of the WSGI-server microprogramming software for network storage devices Zyxel NAS326 and NAS542 allows a hacker to execute any command on the operating system.
The vulnerability of the WSGI-server microprogramming software for network storage devices Zyxel NAS326 and NAS542 exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute an...
CVE-2023-37928
A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an authenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable devic...
CVE-2023-4474
The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...
CVE-2023-4474
The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...
CVE-2023-37928
A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an authenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable devic...
Input validation
The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...
Command injection
A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an authenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable devic...
CVE-2023-4474
CVE-2023-4474 affects Zyxel NAS326 and NAS542 devices. The root cause is improper neutralization of special elements in the WSGI server, allowing an unauthenticated attacker to execute OS commands by sending a crafted URL. Affected firmwares: NAS326 up to V5.21(AAZF.14)C0 and NAS542 up to V5.21(A...
CVE-2023-4474
The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...
CVE-2023-4474
The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...
CVE-2023-37928
CVE-2023-37928 affects Zyxel NAS326 and NAS542: a post-authentication command-injection in the WSGI server could allow an authenticated attacker to execute OS commands via a crafted URL. The 3.1.9 CVE entry notes a high-severity impact (CVSS 8.8; network attack vector, require LOW privileges, no ...
CVE-2023-37928
A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an authenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable devic...
PT-2023-7333 · Zyxel · Zyxel Nas326 +1
Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 version V5.21AAZF.14C0 Zyxel NAS542 version V5.21ABAG.11C0 Description: The issue arises from the improper neutralization of special elements in the WSGI server, allowing an unauthenticated attacker to execute some operating syst...
An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.
...
OESA-2023-1698 python-gevent security update
gevent is a coroutine -based Python networking library that uses greenlet to provide a high-level synchronous API on top of the libev or libuv event loop. Security Fixes: An issue in Gevent Gevent before version 23.9.1 allows a remote attacker to escalate privileges via a crafted script to the...
AZL-30058 CVE-2023-41419 affecting package python-gevent for versions less than 1.3.6-9
An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component...