CVE-2022-40126: Files or Directories Accessible to External Parties

A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arbitrary commands when Service Mode is activated...

PT-2022-25228 · Unknown · Clash For Windows

Name of the Vulnerable Software and Affected Versions: Clash for Windows version 0.19.9 Description: A misconfiguration in the Service Mode profile directory allows attackers to escalate privileges and execute arbitrary commands when Service Mode is activated. Recommendations: For Clash for Windo...

Cisco SD-WAN path traversal vulnerability

Cisco SD-WAN is a highly secure cloud-scale architecture from Cisco that is open, programmable, and scalable.Cisco SD-WAN has an access control error vulnerability that stems from improper access control of commands in the application CLI, which could be exploited by an attacker to elevate...

HPESBUX04368 rev.1 - HP-UX Using OpenSSL, Multiple Local and Remote Vulnerabilities

Potential Security Impact: Local: Arbitrary Command Execution, Denial of Service DoS, script injection; Remote: Arbitrary Command Execution, Denial of Service DoS, script injection SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX OpenSSL Software prior to A.01.01.01p.001 CVSS...

Aruba Networks ArubaOS Operating System Command Injection Vulnerability

ArubaOS is the network operating system for Aruba Mobility Controllers, Mobility Masters, and controller-managed Access Points APs.InstantOS is an Arch Linux-based distribution. A command execution vulnerability exists in Aruba Networks ArubaOS and InstantOS. The vulnerability stems from the...

CVE-2022-40628: Improper Control of Generation of Code

This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 inclusive, due to improper control of code generation in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit...

CVE-2022-37879: Improper Neutralization of Special Elements used in a Command

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to comple...

TOTOLINK T6 sub_421AA0 Function Command Injection Vulnerability

TOTOLINK T6 is a wireless dual-band router from China's TOTOLINK Electronics TOTOLINK that supports MQTT protocol and Telnet service. The TOTOLINK T6 suffers from a command injection vulnerability that stems from the sub421AA0 function in cstecgi.cgi failing to properly filter construct command...

TOTOLINK T6 sub_421504 Function Command Injection Vulnerability

TOTOLINK T6 is a wireless dual-band router from China's TOTOLINK Electronics TOTOLINK that supports MQTT protocol and Telnet service. The TOTOLINK T6 suffers from a command injection vulnerability that stems from the sub421504 function in cstecgi.cgi failing to properly filter construct command...

CVE-2022-38826

In TOTOLINK T6 V4.1.5cu.709B20210518, there is an execute arbitrary command in cstecgi.cgi...

CVE-2022-38826: Improper Neutralization of Special Elements used in an OS Command

In TOTOLINK T6 V4.1.5cu.709B20210518, there is an execute arbitrary command in cstecgi.cgi...

TOTOLINK T6: Operating System Command Injection Vulnerability

TOTOLINK T6 is a wireless dual-band router from China's TOTOLINK Electronics TOTOLINK that supports MQTT protocol and Telnet service. The TOTOLINK T6 suffers from a command injection vulnerability that stems from the sub421504 function in cstecgi.cgi failing to properly filter construct command...

PT-2022-24584 · Totolink · Totolink T6

Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.5cu.709 B20210518 Description: The issue allows for the execution of arbitrary commands in the cstecgi.cgi file. Recommendations: For TOTOLINK T6 version 4.1.5cu.709 B20210518, consider disabling access to the...

TOTOLINK A700RU: Operating System Command Injection Vulnerability

TOTOLINK A700RU is a wireless dual-band router from China's Gion Electronics TOTOLINK. TOTOLINK A700RU V7.4cu.2313B20191024 suffers from an operating system command injection vulnerability, which originates from a command injection that can be performed via the lang parameter in the function...

PT-2022-4873 · Quectel · Quectel Em05-Ce

Name of the Vulnerable Software and Affected Versions: Quectel EM05-CE wireless network adapter versions affected versions not specified Description: The issue is related to the microprogram software of Quectel EM05-CE wireless network adapters in Lenovo laptops, which fails to neutralize special...

Apple PDFKit security vulnerability

Apple PDFKit is one of Apple's Apple PDF document generation components. A security vulnerability exists in Apple PDFKit, which can be exploited by attackers to execute illegal commands...

D-Link DSL-3782 Router Privilege Escalation

The vulnerability of the byte4C0160 function in D-Link DSL-3782 router microprogramming software is related to insufficient checking of arguments passed to certain CLI commands. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary commands...

CVE-2022-34869

Undocumented hidden command that can be executed from the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command...

Hardcoded credentials

Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote unauthenticated attacker to execute an arbitrary OS command...

PT-2022-20055 · Fortinet · Fortisoar

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSOAR versions prior to 7.2.1 Description: The issue is related to improper privilege management, allowing a GUI user who has already found a way to modify system files to execute arbitrary Python commands as root. Recommendation...