CVE-2024-21827

A leftover debug code vulnerability exists in the cliserver debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger...

CVE-2024-21827

CVE-2024-21827 affects Tp-Link ER7206 Omada Gigabit VPN Router (1.4.1 Build 20240117 Rel.57421). The vulnerability resides in the cli_server debug functionality, where a hidden/legacy debug path can be triggered via crafted network requests to achieve arbitrary command execution. Talos details a ...

Tp-Link ER7206 Omada Gigabit VPN Router cli_server debug leftover debug code vulnerability

Talos Vulnerability Report TALOS-2024-1947 Tp-Link ER7206 Omada Gigabit VPN Router cliserver debug leftover debug code vulnerability June 25, 2024 CVE Number CVE-2024-21827 SUMMARY A leftover debug code vulnerability exists in the cliserver debug functionality of Tp-Link ER7206 Omada Gigabit VPN...

CVE-2024-38903

H3C Magic R230 V100R002's udpserver opens port 9034, allowing attackers to execute arbitrary commands...

CVE-2024-38903

H3C Magic R230 V100R002's udpserver opens port 9034, allowing attackers to execute arbitrary commands...

PT-2024-28271 · H3C · H3C Magic R230

Name of the Vulnerable Software and Affected Versions: H3C Magic R230 version V100R002 Description: The issue allows attackers to execute arbitrary commands due to the udpserver opening port 9034. Recommendations: For H3C Magic R230 version V100R002, consider restricting access to port 9034 as a...

ASUS Download Master Buffer Overflow Vulnerability

ASUS Download Master is a download program from the Chinese company Asus ASUS. A buffer overflow vulnerability exists in ASUS Download Master. The vulnerability stems from a boundary error when the application handles untrusted input. An attacker could exploit the vulnerability to execute arbitra...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary command execution in Less [CVE-2022-48624]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary command execution in Less, caused by a flaw with omitting shellquote calls for LESSCLOSE in the closealtfile function in filename.c CVE-2022-48624. Less is included as a Base OS package used by our...

[SECURITY] [DSA 5715-1] composer security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5715-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 18, 2024 https://www.debian.org/security/faq -...

Debian dsa-5715 : composer - security update

The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5715 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5715-1 [email protected]...

The vulnerability of the Qlik Sense Enterprise data analysis platform, related to insufficient validation of input data, allows a perpetrator to enhance their privileges and execute arbitrary commands on the server.

The vulnerability of the Qlik Sense Enterprise data analysis platform is related to insufficient validation of entered data. Exploiting this vulnerability can allow a malicious actor to enhance their privileges and execute arbitrary commands on the server...

CVE-2024-31161

The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerability to upload any file to any location. They may even upload malicious web page files to the website directory, allowing arbitrary system...

The vulnerability of the microprogrammed software for Zyxel NAS326 and Zyxel NAS542 lies in the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the microprogrammed software for Zyxel NAS326 and Zyxel NAS542 lies in the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending a...

SUSE CVE-2024-35235

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the...

Pandora Security Breach

Pandora is an analytics framework used to find out if a file is suspicious and display the results conveniently. A security vulnerability exists in Pandora FMS versions 700 through prior to 777 that stems from improper input validation, which could allow an attacker to execute arbitrary system...

Vulnerability of the close_altfile() function (filename.c) for UNIX-like system text terminals: allowing attackers to execute arbitrary commands

The vulnerability of the closealtfile function filename.c for UNIX-like system text terminals is related to the omission of the Shellquote call for LESSCLOSE. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

CVE-2024-5585

The CVE-2024-5585 issue affects PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8. It is a follow-on to CVE-2024-1874: the fix for that vulnerability does not work when the command name includes trailing spaces while using proc_open() with array syntax, enabling potent...

CVE-2024-36604

Tenda O3V2 v1.0.0.123880 was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function. This vulnerability allows attackers to execute arbitrary commands with root privileges...

Arbitrary Command Execution

typo3/cms is vulnerable to Arbitrary Command Execution. The vulnerability is due to improper handling of the "From" header when an email comes from a non-trusted source and when no "Return-Path" is configured, which allows an attacker to execute arbitrary shell commands on the server. Note that...

RHEL 7 : mercurial (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - mercurial: arbitrary command execution in mercurial repo with a git submodule CVE-2017-17458 - The...