TOTOLINK X5000R setWiFiWpsCfg Method Command Injection Vulnerability

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in TOTOLINK X5000R version v9.1.0cu.2350b20230313. The vulnerability stems from the setWiFiWpsCfg method of /cgi-bin/cstecgi.cgi failing to properly filter constructed command special...

TOTOLINK X5000R 操作系统命令注入漏洞

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in TOTOLINK X5000R version v9.1.0cu.2350b20230313. The vulnerability stems from the setUPnPCfg method of /cgi-bin/cstecgi.cgi failing to properly filter constructed command special...

CVE-2024-29831 Apache DolphinScheduler: RCE by arbitrary js execution

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2...

CVE-2024-41237

A SQL injection vulnerability in /smsa/teacherlogin.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter...

CVE-2024-34021

Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploaded to the affected product by a logged-in user with an administrative privilege, resulting in an arbitrary OS command execution...

The vulnerability of Microprogrammed Software for FutureNet NXR, FutureNet VXR, and FutureNet WXR arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to gain unauthorized access to protected information, execute arbitrary commands, or cause service failures.

The vulnerability of the microprogrammed software of FutureNet NXR, FutureNet VXR, and FutureNet WXR is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

Apple macOS ramrod arbitrary argv[0] execution vulnerability

Talos Vulnerability Report TALOS-2024-2010 Apple macOS ramrod arbitrary argv0 execution vulnerability July 30, 2024 CVE Number CVE-2024-40800 SUMMARY An arbitrary argv0 execution vulnerability exists in the ramrod binary of Apple macOS version 14.5 23F79 x8664. An attacker can inject an arbitrary...

SiberianCMS SQL注入漏洞

SiberianCMS is an enterprise-level content management system that offers a variety of features for creating and managing web content. SiberianCMS suffers from a SQL injection vulnerability that originates from the system failing to properly neutralize special elements in SQL commands. The...

CVE-2024-6881

CVE-2024-6881 concerns a stored XSS in M-Files Hubshare prior to version 5.0.6.0 . The issue allows an authenticated attacker to execute arbitrary JavaScript in a user’s browser session. Affected component is the Hubshare web interface; root cause is a stored XSS condition in the application flow...

SKYSEA Client View 安全漏洞

SKYSEA Client View is a software from SKYSEA Japan that supports information leakage countermeasures and IT operations management. A security vulnerability exists in SKYSEA Client View versions 15.200.13i through 19.210.04e, which stems from a path traversal vulnerability that could allow an...

CVE-2024-7047 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user...

CVE-2024-26020

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability...

CVE-2024-26020

CVE-2024-26020 : The vulnerability affects Ankitects Anki 24.04, where the MPV functionality in flashcards processes user-supplied content and can trigger arbitrary code execution via a crafted flashcard. Multiple connected sources corroborate exploitation potential and assign high/critical impac...

OS Command Injection

Nuclei is vulnerable to OS Command Injection. The vulnerability is due to the -code option in code templates, allowing users to edit and execute workflow files in some web applications, leading to arbitrary command execution...

CVE-2024-6542 Livestatus injection in mknotifyd

Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk = 2.0.0p39, 2.1.0p47, 2.2.0p32 and 2.3.0p11 allows arbitrary livestatus command execution...

TOTOLINK A6000R 安全漏洞

TOTOLINK A6000R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A6000R suffers from a command injection vulnerability that stems from the ifname parameter in the apclidoenrpinwps function failing to properly filter construct command special characters, commands, and so o...

The vulnerability of the UserScriptHumster class in the SolarWinds Access Rights Manager (ARM) access control software allows a perpetrator to execute arbitrary commands.

The vulnerability of the UserScriptHumster class in the SolarWinds Access Rights Manager ARM access control software is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

CVE-2024-40644

gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gix-path can be tricked into running another git.exe placed in an untrusted location by a limited user account on Windows systems. Windows permits limited user accounts without administrative privileges to create new...

SQL Injection Vulnerability in e-cology 9 of Shanghai Panmicro Network Technology Co.

e-cology 9 is a large-scale collaborative management platform for enterprises. A SQL injection vulnerability exists in e-cology 9 of Shanghai Panmicro Network Technology Co. Under default configuration, an unauthorized attacker can exploit this vulnerability to execute arbitrary SQL statements,...

CVE-2024-40733

NetBox v4.0.3 is affected by a cross-site scripting (XSS) vulnerability that allows execution of arbitrary web scripts/HTML via a crafted payload injected into the Name field at /dcim/front-ports/{id}/edit/. The Red Hat entry and CNVD/CNNVD entries corroborate this issue. The Connected documents ...