11797 matches found
NETGEAR R6850 c4-IPAddr Parameter Command Injection Vulnerability
The NETGEAR R6850 is a wireless router from NETGEAR. The NETGEAR R6850 suffers from a command injection vulnerability that stems from the c4-IPAddr parameter failing to properly filter constructed command special characters, commands, and so on. An attacker can exploit this vulnerability to cause...
CVE-2024-2029: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists in the TranscriptEndpoint of mudler/localai, specifically within the audioToWav function used for converting audio files to WAV format for transcription. The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing the...
NETGEAR R6850 ntp_server Parameter Command Injection Vulnerability
The NETGEAR R6850 is a wireless router from NETGEAR. The NETGEAR R6850 suffers from a command injection vulnerability that stems from the ntpserver parameter failing to properly filter constructed command special characters, commands, and so on. An attacker can exploit this vulnerability to cause...
Multiple programming languages fail to escape arguments properly in Microsoft Windows
Overview Various programming languages lack proper validation mechanisms for commands and in some cases also fail to escape arguments correctly when invoking commands within a Microsoft Windows environment. The command injection vulnerability in these programming languages, when running on Window...
CVE-2023-49134
A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point EAP115 V4 v5.0.4 Build 20220216. A specially crafted series of network requests can lea...
CVE-2023-49134
A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point EAP115 V4 v5.0.4 Build 20220216. A specially crafted series of network requests can lea...
CVE-2023-49133
A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point EAP115 V4 v5.0.4 Build 20220216. A specially crafted series of network requests can lea...
CVE-2023-49134
A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point EAP115 V4 v5.0.4 Build 20220216. A specially crafted series of network requests can lea...
CVE-2023-49134
The CVE-2023-49134 entry is associated with TP-Link AC1350 (EAP225 V3) and N300 (EAP115 V4) devices and is substantiated by TALOS-2023-1862. A command-execution vulnerability exists in the tddpd enable_test_mode function. When the TDDP service (UDP-based) is accessible during the initial runtime ...
CVE-2023-49133
The CVE-2023-49133 family affects TP-Link AC1350 (EAP225 V3) and N300 (EAP115 V4) devices via the tddpd enable_test_mode function exposed over the TP-Link Device Debug Protocol (TDDP). Talos documents a command-execution path: unauthenticated network requests trigger enable_test_mode, which can f...
CVE-2023-49133
A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point EAP115 V4 v5.0.4 Build 20220216. A specially crafted series of network requests can lea...
TP-LINK AC1350 command injection vulnerability
The TP-LINK AC1350/N300 is a router from China P&L TP-LINK. A security vulnerability exists in the TP-LINK AC1350/N300, which can be exploited by an attacker to cause arbitrary commands to be executed via a series of specially crafted network requests...
PT-2024-3580
Name of the Vulnerable Software and Affected Versions Lenovo ThinkSystem, ThinkAgile, NeXtScale, and Lenovo CP-CB-10 affected versions not specified SMM/SMM2 and FPC affected versions not specified Description A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an...
PT-2024-13917 · Hcl · Hcl Dryice Myxalytics
Name of the Vulnerable Software and Affected Versions: HCL DRYiCE MyXalytics affected versions not specified Description: The issue is related to an insecure SQL interface, which could allow an attacker to execute custom SQL queries, including modifying system configurations. A malicious user can...
TP-LINK AC1350 command injection vulnerability
The TP-LINK AC1350/N300 is a router from China P&L TP-LINK. The TP-LINK AC1350 and TP-LINK N300 suffer from a command injection vulnerability that stems from the tddpd enabletestmode function failing to correctly filter constructed command special characters, commands, and so on. An attacker can...
JuiceFSRuntime Orchestrator Kubernetes Accelerator Command Execution
The vulnerability of the JuiceFSRuntime orchestrator for distributed data sets and the open-source Kubernetes accelerator for applications with intensive data processing exists due to the lack of measures taken to eliminate special elements used in the operating system command set. Exploiting thi...
Cockpit Server Arbitrary Command Execution
The vulnerability of the Cockpit server management system is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...
client framework for AI
The vulnerability of the Client framework for AI and Python Ray application development lies in insufficiently checking incoming requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using specially crafted requests...