NETGEAR R6850 ntp_server Parameter Command Injection Vulnerability

The NETGEAR R6850 is a wireless router from NETGEAR. The NETGEAR R6850 suffers from a command injection vulnerability that stems from the ntpserver parameter failing to properly filter constructed command special characters, commands, and so on. An attacker can exploit this vulnerability to cause...

PT-2024-20577 · Traccar · Traccar

Name of the Vulnerable Software and Affected Versions: Traccar versions prior to 6.0 Description: Traccar is an open source GPS tracking system. The issue allows for path traversal and unrestricted upload of files with dangerous types. Since the system allows registration by default, attackers ca...

csmock security vulnerability

csmock is a tool automation approach to scanning SRPMs through static analysis tools by csutils open source. A security vulnerability exists in csmock. An attacker exploited the vulnerability to execute arbitrary commands against OSH staff...

CVE-2024-29269

An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter...

CVE-2024-2243: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in csmock where a regular user of the OSH service anyone with a valid Kerberos ticket can use the vulnerability to disclose the confidential Snyk authentication token and to run arbitrary commands on OSH workers...

Multiple programming languages fail to escape arguments properly in Microsoft Windows

Overview Various programming languages lack proper validation mechanisms for commands and in some cases also fail to escape arguments correctly when invoking commands within a Microsoft Windows environment. The command injection vulnerability in these programming languages, when running on Window...

Aim code injection vulnerability

Aim is an easy-to-use and high-performance open source experiment tracker from the United States. Aim suffers from a code injection vulnerability. The vulnerability stems from the application failing to properly filter special elements of constructed code segments. An attacker could exploit the...

PT-2024-18641 · Unknown · Mudler/Localai

Name of the Vulnerable Software and Affected Versions: mudler/localai versions prior to v2.10.0 Description: A command injection issue exists in the TranscriptEndpoint of mudler/localai, specifically within the audioToWav function used for converting audio files to WAV format for transcription. T...

CVE-2024-2029: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability exists in the TranscriptEndpoint of mudler/localai, specifically within the audioToWav function used for converting audio files to WAV format for transcription. The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing the...

NETGEAR R6850 c4-IPAddr Parameter Command Injection Vulnerability

The NETGEAR R6850 is a wireless router from NETGEAR. The NETGEAR R6850 suffers from a command injection vulnerability that stems from the c4-IPAddr parameter failing to properly filter constructed command special characters, commands, and so on. An attacker can exploit this vulnerability to cause...

CVE-2024-29269

The Telesquare TLR-2005Ksh LTE router (versions 1.0.0 and 1.1.4 ) is vulnerable to an unauthorized Remote Command Execution (RCE) . The flaw exists in the Cmd parameter, allowing an unauthenticated attacker to execute arbitrary system commands and obtain server permissions, potentially leading to...

CVE-2023-49134

A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point EAP115 V4 v5.0.4 Build 20220216. A specially crafted series of network requests can lea...

CVE-2023-49134

A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point EAP115 V4 v5.0.4 Build 20220216. A specially crafted series of network requests can lea...

CVE-2023-49133

A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point EAP115 V4 v5.0.4 Build 20220216. A specially crafted series of network requests can lea...

CVE-2023-49134

The CVE-2023-49134 entry is associated with TP-Link AC1350 (EAP225 V3) and N300 (EAP115 V4) devices and is substantiated by TALOS-2023-1862. A command-execution vulnerability exists in the tddpd enable_test_mode function. When the TDDP service (UDP-based) is accessible during the initial runtime ...

CVE-2023-49134

A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point EAP115 V4 v5.0.4 Build 20220216. A specially crafted series of network requests can lea...

CVE-2023-49133

A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point EAP115 V4 v5.0.4 Build 20220216. A specially crafted series of network requests can lea...

CVE-2023-49133

A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point EAP115 V4 v5.0.4 Build 20220216. A specially crafted series of network requests can lea...

CVE-2023-49133

The CVE-2023-49133 family affects TP-Link AC1350 (EAP225 V3) and N300 (EAP115 V4) devices via the tddpd enable_test_mode function exposed over the TP-Link Device Debug Protocol (TDDP). Talos documents a command-execution path: unauthenticated network requests trigger enable_test_mode, which can f...

TP-LINK AC1350 command injection vulnerability

The TP-LINK AC1350/N300 is a router from China P&L TP-LINK. The TP-LINK AC1350 and TP-LINK N300 suffer from a command injection vulnerability that stems from the tddpd enabletestmode function failing to correctly filter constructed command special characters, commands, and so on. An attacker can...