TOTOLINK X5000R security vulnerabilities

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X5000R timeout parameter, which originates from the failure of the timeout parameter of /cgi-bin/cstecgi.cgi to properly filter constructed command special characters,...

TOTOLINK X5000R security vulnerabilities

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X5000R password parameter, which originates from the password parameter of /cgi-bin/cstecgi.cgi failing to properly filter constructed command special characters,...

CVE-2024-29895

Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when "registerargcargv" option of PHP is "On". In "cmdrealtime.php" line 119, the "$polleri...

CVE-2024-35205

The WPS Office aka cn.wps.mofficeeng application before 17.0.0 for Android fails to properly sanitize file names before processing them through external application interactions, leading to a form of path traversal. This potentially enables any application to dispatch a crafted library file, aimi...

D-Link DIR-845L Router Command Execution

The vulnerability of the hnapmain function in D-Link DIR-845L router microprogramming software arises from the lack of measures taken to neutralize special elements used in the operating system’s command for processing the SOAP request purenetworks.com/HNAP1/GetDeviceSettings. Exploiting this...

Linksys E5600 Command Injection Vulnerability

Linksys E5600 is a powerful, compact and reliable WiFi 5 router from Linksys USA. A command injection vulnerability exists in the Linksys E5600 v1.1.0.26, which stems from the failure of the PinCode parameter of the /API/info form endpoint to properly filter constructed command special characters...

RHEL 7 : mercurial (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - mercurial: arbitrary command execution in mercurial repo with a git submodule CVE-2017-17458 - The conver...

RHEL 6 : mercurial (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - mercurial: arbitrary command execution in mercurial repo with a git submodule CVE-2017-17458 - mercurial:...

Command Execution Vulnerability in Yisetong Electronic Document Security Management System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-24396)

Yisetong electronic document security management system is a controllable authorization of electronic document security sharing management system, using real-time dynamic encryption and decryption protection technology and real-time rights recovery mechanism, to provide all kinds of electronic...

PT-2024-4483 · Lenovo · Lenovo Service Bridge

Name of the Vulnerable Software and Affected Versions: Lenovo Service Bridge versions prior to 5.0.2.17 Description: A privilege escalation issue was reported that could allow operating system commands to be executed if a specially crafted link is visited. The vulnerability is related to the...

Linksys E5600 Command Injection Vulnerability

Linksys E5600 is a powerful, compact and reliable WiFi 5 router from Linksys USA. A command injection vulnerability exists in Linksys E5600 v1.1.0.26, which stems from the ipurl parameter failing to correctly filter constructed command special characters, commands, and so on. An attacker can...

CVE-2024-25533

Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website /WorkFlow/OfficeFileUpdate.aspx. This vulnerability can allow attackers to write files to the server or execute arbitrary commands via crafted SQL statements...

CVE-2024-25533: Improper Neutralization of Special Elements used in an SQL Command

Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website /WorkFlow/OfficeFileUpdate.aspx. This vulnerability can allow attackers to write files to the server or execute arbitrary commands via crafted SQL statements...

CVE-2024-34257

TOTOLINK EX1800T V9.1.0cu.2112B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges...

Linksys E5600 Router API Command Injection

The vulnerability of the /API/info component of the Linksys E5600 router’s microprogramming system lies in the lack of measures taken to neutralize special elements used in the OS commands. Exploiting this vulnerability allows a malicious actor to inject arbitrary commands using the PinCode...

D-Link DIR-845 security vulnerabilities

The D-Link DIR-845L is a wireless router from China-based AUO D-Link. The D-Link DIR-845L suffers from a command execution vulnerability that can be exploited by an attacker to execute arbitrary commands on the system by sending a specially crafted request...

Linksys E5600 security vulnerabilities

Linksys E5600 is a powerful, compact and reliable WiFi 5 router from Linksys USA. A command injection vulnerability exists in the Linksys E5600 v1.1.0.26, which stems from the failure of the PinCode parameter of the /API/info form endpoint to properly filter constructed command special characters...

[SECURITY] [DSA 5679-1] less security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5679-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 03, 2024 https://www.debian.org/security/faq -...

CVE-2024-33792

netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the tracert page...

NETGEAR RAX30 security vulnerabilities

The NETGEAR RAX30 is a wireless router from NETGEAR. The NETGEAR RAX30 suffers from a command injection vulnerability that stems from a command injection vulnerability when processing UPnP port mapping requests, which can be exploited by an attacker to execute arbitrary commands...