CVE-2024-51304

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ldapsearchdn function...

PT-2024-34592 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: Draytek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet monitor function. Recommendations: For Draytek Vigor3900 version...

CVE-2024-51301

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packetmonitor function...

CyberPanel 安全漏洞

CyberPanel is a web hosting control panel with built-in DNS and email servers by Usman Nasir, an individual developer. CyberPanel has a security vulnerability that originates from getresetstatus in dns/views.py that allows remote attackers to bypass authentication and execute arbitrary commands v...

The vulnerability of the command-line interface of the microprogramming software for Cisco Analog Telephone Adapter (ATA) series 190 allows a perpetrator to execute arbitrary commands.

The vulnerability of the command-line interface of microprogramming software for Cisco Analog Telephone Adapter ATA series 190 devices exists due to the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows an...

The vulnerability of the BufWinLeave function in the Vim text editor allows a hacker to execute arbitrary commands.

The vulnerability of the BufWinLeave function in the Vim text editor is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

CyberPanel 安全漏洞

CyberPanel is a web hosting control panel with built-in DNS and email servers by Usman Nasir, an individual developer. CyberPanel has a security vulnerability that originates from upgrademysqlstatus in databases/views.py that allows remote attackers to bypass authentication and execute arbitrary...

The vulnerability in the `usb_remote_smb_conf.cgi` script of NETGEAR XR1000 Wi-Fi routers allows a hacker to execute arbitrary commands.

The vulnerability in the usbremotesmbconf.cgi script of NETGEAR XR1000 Wi-Fi routers lies in the lack of measures for sanitizing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using the sharename parameter...

Mitel MiCollab Command Injection Vulnerability

Mitel MiCollab is an enterprise-grade unified communications solution that supports voice, video and messaging communications capabilities. A command injection vulnerability exists in Mitel MiCollab version 9.8.0.33, which can be exploited by an attacker to execute arbitrary system commands...

EnGenius ENH1350EXT 安全漏洞

The EnGenius ENH1350EXT is an outdoor wireless access point from EnGenius. A security vulnerability exists in EnGenius ENH1350EXT version 3.9.3.2c1.9.51 and prior versions. An attacker can exploit the vulnerability to execute arbitrary operating system commands with root privileges...

CVE-2024-20275

A vulnerability in the cluster backup feature of Cisco Secure Firewall Management Center FMC Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to...

Cisco Secure Firewall Management Center 安全漏洞

Cisco Secure Firewall Management Center is a security firewall management software from Cisco. A security vulnerability exists in the Cisco Secure Firewall Management Center WEB interface, which can be exploited by remote attackers to submit a special request that can execute arbitrary commands i...

Cisco Secure Firewall Management Center 安全漏洞

Cisco Secure Firewall Management Center is a powerful network security management tool from Cisco USA. A security vulnerability exists in Cisco Secure Firewall Management Center that stems from insufficient validation of user data provided through the web-based management interface. An attacker...

CVE-2024-49368

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue...

CVE-2024-49368 Unchecked logrotate settings lead to arbitrary command execution

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue...

CVE-2024-49368 Unchecked logrotate settings lead to arbitrary command execution

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue...

CVE-2024-49368 Unchecked logrotate settings lead to arbitrary command execution

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue...

D-Link DIR-878 and D-Link DIR-882 Command Injection Vulnerability

The D-Link DIR-878 is a wireless router.The D-Link DIR-882 is a dual-band wireless router. A command injection vulnerability exists in the D-Link DIR-878 and D-Link DIR-882, which can be exploited by an attacker to execute arbitrary operating system commands via a constructed POST request...

D-Link DIR-878 and D-Link DIR-882 Command Injection Vulnerabilities (CNVD-2024-41698)

The D-Link DIR-878 is a wireless router.The D-Link DIR-882 is a dual-band wireless router. A command injection vulnerability exists in the D-Link DIR-878 and D-Link DIR-882, which can be exploited by an attacker to execute arbitrary operating system commands via a constructed POST request...

D-Link DIR-878 and D-Link DIR-882 Command Injection Vulnerability (CNVD-2024-41699)

The D-Link DIR-878 is a wireless router.The D-Link DIR-882 is a dual-band wireless router. A command injection vulnerability exists in the D-Link DIR-878 and D-Link DIR-882, which can be exploited by an attacker to execute arbitrary operating system commands via a constructed POST request...