CVE-2024-29224: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...

CVE-2024-28892: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...

GoCast HTTP API lack of authentication vulnerability

Talos Vulnerability Report TALOS-2024-1962 GoCast HTTP API lack of authentication vulnerability November 21, 2024 CVE Number CVE-2024-21855 SUMMARY A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary...

PT-2024-22820 · Gocast · Gocast

Name of the Vulnerable Software and Affected Versions: GoCast version 1.1.3 Description: An OS command injection issue exists in the NAT parameter of GoCast. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger...

Netgear R8500 admin_account.cgi Command Execution

The vulnerability of the adminaccount.cgi microprogramming system in Netgear R8500 routers exists due to the failure to take measures to neutralize special elements used in the operating system’s command for processing the sysNewPasswd parameter. Exploiting this vulnerability allows a malicious...

NETGEAR R8500 Router Command Execution

The vulnerability in the usbremotesmbconf.cgi script of NETGEAR R8500 router microprogramming software lies in the lack of measures to neutralize special elements used in the operating system’s command when processing the sharename parameter. Exploiting this vulnerability allows a remote attacker...

AZL-53397 CVE-2024-10224 affecting package perl-Module-ScanDeps for versions less than 1.35-3

Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by opening a "pesky pipe" such as passing "commands|" as a filename or by passing arbitrary strings to eval...

CVE-2024-11003

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library Modules::ScanDeps which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps...

[SECURITY] [DLA 3958-1] libmodule-scandeps-perl security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3958-1 [email protected] https://www.debian.org/lts/security/ Salvatore Bonaccorso November 19, 2024 https://wiki.debian.org/LTS -...

[SECURITY] [DSA 5816-1] libmodule-scandeps-perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5816-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 19, 2024 https://www.debian.org/security/faq -...

Debian dsa-5816 : libmodule-scandeps-perl - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5816 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5816-1 [email protected] https://www.debian.org/security/...

Netgear R8500 Router Command Execution

The vulnerability in the password.cgi script of Netgear R8500 router microprogramming software exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by...

CVE-2024-50919

Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command execution...

CVE-2024-50919: Improper Control of Generation of Code

Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command execution...

CVE-2024-22067: Improper Access Control

ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands...

CVE-2024-50919

Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command execution...

CVE-2024-50919

Jpress, a Java-based blogging platform, versions prior to v5.1.1 are vulnerable to an arbitrary file upload vulnerability on the Windows platform . This flaw allows an attacker to construct non-standard file formats, such as .jsp , which can lead to arbitrary command execution . To mitigate this ...

SmartFabric OS10 Privilege Escalation

The vulnerability of the SmartFabric OS10 network operating system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

PT-2025-13829

Name of the Vulnerable Software and Affected Versions Netgear WNR854T version 1.5.2 Description The issue allows for arbitrary command execution in cmd.cgi, enabling the execution of system commands via the web interface. Recommendations For Netgear WNR854T version 1.5.2, consider disabling acces...

PT-2025-13830

Name of the Vulnerable Software and Affected Versions Netgear WNR854T version 1.5.2 Description The issue concerns a command injection vulnerability in the UPNP service, specifically in the addmap exec function. This function parses the NewInternalClient parameter of the "AddPortMapping" SOAPActi...