CVE-2024-29192

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The /api/config endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an...

CVE-2024-29192 GHSL-2023-206 gotortc Cross-Site Request Forgery vulnerability

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The /api/config endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an...

CVE-2024-29192 GHSL-2023-206 gotortc Cross-Site Request Forgery vulnerability

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The /api/config endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an...

CVE-2024-29192

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The "/api/config" endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an...

CVE-2024-2692 SiYuan 3.0.3 - RCE via Server Side XSS

SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS...

CVE-2024-2692

CVE-2024-2692 affects SiYuan version 3.0.3, with a Server-Side XSS weakness that allows an attacker to execute arbitrary commands on the server. The vulnerability is described across multiple sources as enabling remote command execution due to improper handling of input leading to server-side cod...

CVE-2024-2692: Improper Neutralization of Input During Web Page Generation

SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS...

CVE-2024-29192: Cross-Site Request Forgery (CSRF)

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The /api/config endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an...

PT-2024-21583 · Siyuan · Siyuan

Name of the Vulnerable Software and Affected Versions: SiYuan version 3.0.3 Description: The issue allows executing arbitrary commands on the server due to the application being vulnerable to Server Side XSS. Recommendations: For SiYuan version 3.0.3, update to a version that fixes the Server Sid...

NETGEAR R6850 security vulnerabilities

The NETGEAR R6850 is a wireless router from NETGEAR. The NETGEAR R6850 suffers from a command injection vulnerability that stems from the c4-IPAddr parameter failing to properly filter constructed command special characters, commands, and so on. An attacker can exploit this vulnerability to cause...

dashboard component of the

The vulnerability of the dashboard framework for scaling AI and Python Ray applications exists due to the failure to address the issues related to the special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...

Edge Router arbitrary command execution

The vulnerability of the Edge Router user interface of microprogramming software in VMware SD-WAN Edge and the VMware SD-WAN Orchestrator platform for managing programmatically configurable networks is related to the failure to eliminate special elements used in operating systems commands...

Netgear R6850 security vulnerabilities

The NETGEAR R6850 is a wireless router from NETGEAR. The NETGEAR R6850 suffers from a command injection vulnerability that stems from the ntpserver parameter failing to properly filter constructed command special characters, commands, and so on. An attacker can exploit this vulnerability to cause...

TP-LINK AX1500 OS Command Injection Vulnerability

The TP-LINK AX1500 is a modem from China P&L TP-LINK. The TP-LINK AX1500 suffers from an operating system command injection vulnerability that arises from an improper neutralization of special elements used in operating system commands, which can be exploited by an attacker to cause arbitrary...

Cisco IOS XE Command Injection

The vulnerability of the command-line interface CLI of Cisco IOS XE operating systems is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary commands with root privileges...

CVE-2024-29433

A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data...

ALLDATA security vulnerabilities

ALLDATA is an online resource for automotive OEM information from ALLDATA, Inc. It provides diagnostic and repair information for vehicle manufacturers. A security vulnerability exists in ALLDATA version v0.4.6 that originated from allowing an attacker to run arbitrary commands via the processId...

PT-2024-22895 · Alldata · Alldata

Name of the Vulnerable Software and Affected Versions: Alldata version 0.4.6 Description: An issue in Alldata allows an attacker to run arbitrary commands via the processId parameter. Recommendations: For Alldata version 0.4.6, avoid using the processId parameter until a fix is available. As a...

CVE-2024-29433: Deserialization of Untrusted Data

A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data...

Dell vApp Manager Operating System Command Injection Vulnerability

Dell vApp Manager is a virtual application manager from Dell USA. An operating system command injection vulnerability exists in Dell vApp Manager versions prior to 9.2.4.9, which can be exploited by an attacker to execute arbitrary commands on the system...