[SECURITY] [DSA 5816-1] libmodule-scandeps-perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5816-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 19, 2024 https://www.debian.org/security/faq -...

Debian dsa-5816 : libmodule-scandeps-perl - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5816 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5816-1 [email protected] https://www.debian.org/security/...

Netgear R8500 Router Command Execution

The vulnerability in the password.cgi script of Netgear R8500 router microprogramming software exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by...

CVE-2024-50919

Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command execution...

CVE-2024-50919: Improper Control of Generation of Code

Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command execution...

CVE-2024-22067: Improper Access Control

ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands...

CVE-2024-50919

Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command execution...

CVE-2024-50919

Jpress, a Java-based blogging platform, versions prior to v5.1.1 are vulnerable to an arbitrary file upload vulnerability on the Windows platform . This flaw allows an attacker to construct non-standard file formats, such as .jsp , which can lead to arbitrary command execution . To mitigate this ...

SmartFabric OS10 Privilege Escalation

The vulnerability of the SmartFabric OS10 network operating system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

PT-2025-13829

Name of the Vulnerable Software and Affected Versions Netgear WNR854T version 1.5.2 Description The issue allows for arbitrary command execution in cmd.cgi, enabling the execution of system commands via the web interface. Recommendations For Netgear WNR854T version 1.5.2, consider disabling acces...

PT-2025-13830

Name of the Vulnerable Software and Affected Versions Netgear WNR854T version 1.5.2 Description The issue concerns a command injection vulnerability in the UPNP service, specifically in the addmap exec function. This function parses the NewInternalClient parameter of the "AddPortMapping" SOAPActi...

D-Link Router Command Injection

The vulnerability of D-Link DSL-2640U and DSL-2540U router microprogramming systems lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands using metasymbols within the...

Tenda G3 formSetUSBPartitionUmount function command injection vulnerability

Tenda G3 is a Qos Vpn router from Tenda China. Tenda G3 suffers from a command injection vulnerability, which stems from the formSetUSBPartitionUmount function failing to properly filter constructor command special characters, commands, etc. The vulnerability can be exploited to execute arbitrary...

D-Link DSL6740C OS Command Injection Vulnerability (CNVD-2024-45428)

The D-Link DSL6740C is a wireless VDSL router from China-based AUO D-Link. The D-Link DSL6740C suffers from an operating system command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the system...

Tenda G3 formSetDebugCfg function command injection vulnerability

Tenda G3 is a Qos Vpn router from Tenda China. Tenda G3 suffers from a command injection vulnerability, which stems from the formSetDebugCfg function failing to properly filter constructor command special characters, commands, etc. The vulnerability can be exploited to execute arbitrary commands...

CVE-2024-52505 matrix-appservice-irc allows IRC Command injection in provisioning API

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in...

TOTOLINK X18 Command Injection Vulnerability

TOTOLINK X18 is a mesh router system from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X18 version 9.1.0cu.2024B20220329, which stems from the enable parameter in the /cgi-bin/cstecgi.cgi page failing to correctly filter constructed command special...

D-Link DI-8003 Command Injection Vulnerability

The D-Link DI-8003 is a wireless router from China-based AUO D-Link. A command injection vulnerability exists in the D-Link DI-8003 version 16.07.16A1, which stems from the parameter path in the file /upgradefilter.asp failing to correctly filter construct command special characters, commands, et...

Tenda G3 command injection vulnerability

Tenda G3 is a Qos Vpn router from Tenda China. Tenda G3 suffers from a command injection vulnerability, which stems from the formSetUSBPartitionUmount function failing to properly filter constructor command special characters, commands, etc. The vulnerability can be exploited to execute arbitrary...

Juniper Networks Junos Space Command Execution

The vulnerability of the Juniper Networks Junos Space network resource management platform lies in the lack of measures taken to sanitize input data at the control level. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafted requests...