18168 matches found
Hardcoded credentials
An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root...
Tenda M3 TendaTelnet Method Command Execution Vulnerability
Tenda M3 is an access controller from Tenda, China. A command execution vulnerability exists in Tenda M3 version V1.0.0.124856, which stems from the failure of the TendaTelnet method to properly filter constructed command special characters, commands, etc. The vulnerability can be exploited to...
CVE-2023-45741
VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product's web management page to execute arbitrary OS commands...
Design/Logic Flaw
VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product's web management page to execute arbitrary OS commands...
CVE-2023-49226
An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root...
Command injection
An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root...
CVE-2023-49226
An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root...
TOTOLINK EX1800T 安全漏洞
The TOTOLINK EX1800T is a Wi-Fi range extender from China's Gion Electronics TOTOLINK. A command execution vulnerability exists in the TOTOLINK EX1800T setWiFiApConfig interface, which originates from the failure of the opmode parameter of the cstecgi .cgi's setWiFiApConfig interface to correctly...
TOTOLINK EX1200L 安全漏洞
TOTOLINK EX1200L is a dual-band wireless signal booster, mainly used to extend Wi-Fi coverage in home or office environments, solving the problem of weak signals or dead spots. The TOTOLINK EX1200L suffers from a command execution vulnerability that stems from the setOpModeCfg interface of...
TOTOLINK EX1800T 安全漏洞
The TOTOLINK EX1800T is a Wi-Fi range extender from China's Gion Electronics TOTOLINK. A command execution vulnerability exists in the TOTOLINK EX1800T setWiFiExtenderConfig interface, which originates from the apcliAuthMode parameter of the cstecgi .cgi's setWiFiExtenderConfig interface that fai...
Vinchin Backup And Recovery Command Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Vinchin Backup and Recovery Command Injection', 'Description' = %q This module exploits a command injection vulnerability in Vinchin Backup &...
Server Side Template Injection (SSTI)
mlflow is vulnerable to Server-side Template Injection SSTI. The vulnerability is due to not using the sandboxed jinja2 loader while merging and rendering profile/recipe configuration yaml files in the renderandmergeyamlfunction within mlflow/utils/fileutils.py. If a user loads a malicious recipe...
The vulnerability of the FortiWAN traffic balancing system lies in the incorrect restriction on the path name to the restricted access catalog. This allows a malicious actor to gain read, modify, or delete access to data, as well as execute arbitrary commands.
The vulnerability of the FortiWAN traffic balancing system lies in incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor to gain read, modify, or delete access to data, as well as execute arbitrary commands by sending specially...
The vulnerability of Siemens SCALANCE and RUGGEDCOM industrial switches lies in the insufficient checking of arguments passed in commands, allowing attackers to execute arbitrary commands.
The vulnerability of Siemens SCALANCE and RUGGEDCOM industrial switches lies in insufficient verification of the arguments passed in the commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
CVE-2023-39509
A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS of the camera...
CVE-2023-39509
A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS of the camera...
Debian: Security Advisory (DSA-5578-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
ZTE MC801A Command Injection Vulnerability
The ZTE MC801A is a 5g indoor WiFi router from China's ZTE ZTE. The ZTE MC801A suffers from an input validation vulnerability in the handling of multiple network parameters, which can be exploited by a remote attacker to submit a special request that can be used in the application context to...
CVE-2021-42796
An issue was discovered in ExecuteCommand in AVEVA Edge formerly InduSoft Web Studio versions R2020 and prior that allows unauthenticated arbitrary commands to be executed...
Design/Logic Flaw
An issue was discovered in ExecuteCommand in AVEVA Edge formerly InduSoft Web Studio versions R2020 and prior that allows unauthenticated arbitrary commands to be executed...