CVE-2024-52010

CVE-2024-52010 concerns Zoraxy, a general-purpose HTTP reverse proxy/forwarding tool, with a vulnerability in the Web SSH feature. In HandleCreateProxySession , the request to create an SSH session handles a user-supplied username that can be injected into the sshCommand ; the username is not val...

CVE-2024-52010 Zoraxy has an authenticated command injection in the Web SSH feature

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH...

CVE-2024-52010 Zoraxy has an authenticated command injection in the Web SSH feature

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH...

bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution

A flaw was found in the HID Profile in BlueZ that opens doors for unauthorized connections, especially by devices like keyboards, to inject keystrokes without user confirmation. BlueZ lacks proper restrictions on non-bonded devices, creating a risk for attackers that are physically close to injec...

Dell SmartFabric OS10 命令注入漏洞

Dell SmartFabric OS10 is a Debian Linux-based network operating system from Dell Networking designed to run on its PowerSwitch platform. A command injection vulnerability exists in Dell SmartFabric OS10 that stems from the system not filtering and validating user input at command execution. An...

D-Link DSL6740C 操作系统命令注入漏洞

The D-Link DSL6740C is a wireless VDSL router from China's AUO D-Link. The D-Link DSL6740C suffers from an operating system command injection vulnerability, which can be exploited by a remote attacker with administrator privileges to inject and execute arbitrary system commands via specific...

Command Execution Vulnerability in Changjitong T+ of Changjitong Information Technology Co.

T+ is a new Internet-based business management software. Ltd. A command execution vulnerability exists in Changjitong T+, which can be exploited by attackers to execute arbitrary commands...

D-Link DSL6740C 操作系统命令注入漏洞

The D-Link DSL6740C is a wireless VDSL router from China-based AUO D-Link. The D-Link DSL6740C suffers from an operating system command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the system...

Cisco Releases Patch for Critical URWB Vulnerability in Industrial Wireless Systems

Cisco has released security updates to address a maximum severity security flaw impacting Ultra-Reliable Wireless Backhaul URWB Access Points that could permit unauthenticated, remote attackers to run commands with elevated privileges. Tracked as CVE-2024-20418 CVS score: 10.0, the vulnerability...

D-Link DIR-823G SetNetworkTomographySettings Function Command Injection Vulnerability

The D-Link DIR-823G is a wireless router from China's AUO D-Link. The D-Link DIR-823G suffers from a command injection vulnerability that stems from the Address parameter in the SetNetworkTomographySettings function failing to properly filter construct command special characters, commands, and so...

CyberPanel upgrademysqlstatus authentication bypass and command injection

Added: 11/07/2024 Background CyberPanel is a web hosting control panel. Problem A pair of vulnerabilities in the upgrademysqlstatus web resource could allow a remote attacker to bypass authentication using a PUT request and execute arbitrary commands with a specially crafted statusfile parameter...

CVE-2024-47461

An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to...

CVE-2024-47461

CVE-2024-47461 is an authenticated command-injection flaw in Aruba Instant AOS-8 and AOS-10 CLI that allows arbitrary commands to run with high privileges, potentially compromising the OS. Affected components: Instant AOS-8/AOS-10 CLI. Root cause: authenticated RCE via command injection in the CL...

CVE-2023-29120

CVE-2023-29120 affects the Waybox Enel X web management application. The vulnerability description indicates it could be used to execute arbitrary OS commands and grant administrator privileges on the Waybox system (remote code execution with high impact). The connected documents corroborate a ri...

CVE-2024-51024

D-Link DIR823G 1.0.2B05 was discovered to contain a command injection vulnerability via the HostName parameter in the SetWanSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51023

D-Link DIR823G 1.0.2B05 was discovered to contain a command injection vulnerability via the Address parameter in the SetNetworkTomographySettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51009

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at ether.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-50999

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at password.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

NETGEAR R7000P 安全漏洞

The NETGEAR R7000P is a wireless router from NETGEAR. A command injection vulnerability exists in NETGEAR R7000P v1.3.3.154, which stems from the devicename2 parameter in the operationmode.cgi component failing to correctly filter constructed command special characters, commands, and so on. An...

Enel X Waybox 安全漏洞

Enel X Waybox is a home charging station from Enel X, Inc. A security vulnerability exists in version 3.0 of the Enel X Waybox that stems from a web management application that can be used to execute arbitrary operating system commands and provide administrator privileges to the Waybox system...