Roxy-WI 命令注入漏洞

Roxy-WI is an open source web interface for managing Haproxy, Nginx and Keepalived servers. A command injection vulnerability exists in Roxy-WI versions prior to 6.1.1.0, which stems from the ability to remotely run system commands via the subprocessexecute function...

CVE-2022-31161 Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload

Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocessexecute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for...

CVE-2022-31161

CVE-2022-31161 affects Roxy-WI prior to version 6.1.1.0, where the system command can be executed remotely through inputs handled in /app/options.py (notably via the subprocess_execute path). The issue enables unauthenticated remote code execution by abusing input handling (e.g., delcert/ssl_cert...

CVE-2022-34756

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs stack which is used for the device Web HMI. Affected Products: Easergy P5 V01.401.102 and prior...

The vulnerability of the DA50N network switch’s web interface allows a intruder to gain unauthorized access to protected information.

The vulnerability of the DA50N network switch web interface is related to insufficient protection of registration data. Exploiting this vulnerability can allow an unauthorized attacker to gain unauthorized access to protected information...

The vulnerability of the DA50N network switch web interface allows a hacker to gain full access to the device.

The vulnerability of the DA50N network switch web interface is related to weak password requirements. Exploiting this vulnerability can allow a remote attacker to gain full access to the device...

The vulnerability of the DA50N network switch web interface allows a hacker to execute arbitrary code.

The vulnerability of the DA50N network switch web interface is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by loading a specially crafted image...

CVE-2021-40336

A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web browser, such as to steal the session...

CVE-2021-40335

A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery CSRF, which if exploited could lead an attack...

CVE-2022-29560

A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions 2.15.1, RUGGEDCOM ROX MX5000RE All versions 2.15.1, RUGGEDCOM ROX RX1400 All versions 2.15.1, RUGGEDCOM ROX RX1500 All versions 2.15.1, RUGGEDCOM ROX RX1501 All versions 2.15.1, RUGGEDCOM ROX RX1510 All versions 2.15.1,...

Softing Secure Integration Server 安全漏洞

Softing Secure Integration Server is a secure integration server from Softing Germany. It provides a powerful OPC UA data integration layer and supports interface abstraction, aggregation, data preprocessing and security supervision. A security vulnerability exists in Softing Secure Integration...

ytdl-sync 路径遍历漏洞

The ytdl-sync repository is a web interface for YTDL by Jake Garza, an individual developer in the United States. A security vulnerability exists in ytdl version 2021-01-02 and earlier, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

The vulnerability of the ssh_command function in the web interface for managing Roxy-wi servers allows a hacker to execute arbitrary code.

The vulnerability of the sshcommand function in the web interface for managing Roxy-wi servers is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability in the web interface for diagnosing micro-program software in the Bosch PRA-ES8P2S Ethernet switch allows a hacker to execute arbitrary operating system commands.

The vulnerability of the web-based interface for diagnosing micro-programmed Ethernet switch software from Bosch, the PRA-ES8P2S, is related to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands using...

The vulnerability in the web interface of the Cisco Smart Software Manager On-Prem administration tool allows a perpetrator to trigger a service failure.

The vulnerability in the web interface of the Cisco Smart Software Manager On-Prem administration tool is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

CVE-2022-31137

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocessexecute function without processing the inputs received from the user in the...

CVE-2022-31137 Unauthenticated Remote Code Execution in Roxy-WI

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocessexecute function without processing the inputs received from the user in the...

CVE-2022-31137

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocessexecute function without processing the inputs received from the user in the...

CVE-2022-20812

Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco...

CVE-2022-20800

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM, Cisco Unified Communications Manager Session Management Edition Unified CM SME, Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P, and Cisco Unity Connection could...