618 matches found
CVE-2021-33962
China Mobile An Lianbao WF-1 router v1.0.1 is affected by an OS command injection vulnerability in the web interface component /api/ZRUsb/pop_usb_device. The issue originates from a lack of proper command filtering and escaping in the web interface, enabling an attacker to inject OS commands. The...
PT-2022-10303
Name of the Vulnerable Software and Affected Versions China Mobile An Lianbao WF-1 router version 1.0.1 Description The issue is an OS command injection vulnerability in the web interface, specifically in the /api/ZRUsb/pop usb device component. This allows for potential exploitation through the...
CVE-2021-33962: Improper Neutralization of Special Elements used in an OS Command
China Mobile An Lianbao WF-1 router v1.0.1 is affected by an OS command injection vulnerability in the web interface /api/ZRUsb/popusbdevice component...
Bazaar Web PHP Social Listings Shell Upload Vulnerability
-- Exploit Title: Bazaar Web PHP Social Listings Arbitrary File Upload Exploit Author: Sohel Yousef - email protected Software Link: https://codecanyon.net/item/bazaar-social-listing-shopping-web-php-template/23207913 Software Demo :https://xserver.app/apps/bazaar-web/index.php Category: webapps ...
PT-2021-20745
Name of the Vulnerable Software and Affected Versions: Bentley View version 10.15.0.75 Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this, where the target must visit a malicious page or open a...
mediummundi.pl Improper Access Control vulnerability OBB-2181585
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
in star7th/showdoc
Description - CWE: CWE-288:Authentication Bypass Using an Alternate Path or Channel - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L , CVSS Score: 8.3High - Credit：Qianxin, Network Security Department, Product-Safety Team Unc1e In showdoc, there is a SSO process , DOC is shown in...
GHSA-6HFQ-H8HQ-87MF HTTP Request Smuggling in hyper
Summary hyper's HTTP server code had a flaw that incorrectly understands some requests with multiple transfer-encoding headers to have a chunked payload, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that understands the request payload boundary different...
CVE-2020-28846
Cross Site Request Forgery CSRF vulnerability exists in SeaCMS 10.7 in adminmanager.php, which could let a malicious user add an admin account...
CVE-2021-33910
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value involving strdupa and alloca for a pathname controlled by a local attacker that results in an operating system crash...
CVE-2021-33910: Allocation of Resources Without Limits or Throttling
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value involving strdupa and alloca for a pathname controlled by a local attacker that results in an operating system crash...
Zhongbang CRMEB 代码问题漏洞
Zhongbang CRMEB is an open source e-commerce management system from Zhongbang Networks Zhongbang in Xi'an, China. A security vulnerability exists in CRMEB 3.1.0+, which stems from the strict domain name filtering in CRMEB 3.1.0+ leading to SSRF Server Side Request Forgery. No detailed vulnerabili...
PT-2021-29004
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.12.9 Description The issue is related to the btrfs filesystem, where a release path is not properly handled before starting a transaction when cloning an inline extent. This could potentially lead to security...
China Mobile An Lianbao WF-1 Router Command Injection (CVE-2021-30231; CVE-2021-30228; CVE-2021-30230; CVE-2021-30232; CVE-2021-30233; CVE-2021-30234)
A command injection vulnerability exists in China Mobile An Lianbao WF-1 router. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
CVE-2021-1895
Possible integer overflow due to improper length check while flashing an image in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music...
CVE-2021-30229
The api/zrDm/setzrDm interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the dmenable, AppKey, or Pwd parameter...
CVE-2021-30230
The api/ZRFirmware/settimezone interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the zonename parameter...
CVE-2021-30233
The api/ZRIptv/setIptvInfo interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iptvvlan parameter...
CVE-2021-30231
The api/zrDm/setZRElink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the bssaddr, abiaddr, devtoken, devid, elinksync, or elinkprocenable parameter...