Tenda AC6 buffer error vulnerability

Tenda AC6 is a wireless router from Tenda, China. Tenda AC6 is vulnerable to a buffer overflow vulnerability, which stems from the deviceId parameter in the saveParentControlInfo function that does not properly validate data boundaries when performing operations on memory, and can be exploited by...

Tenda AC6 buffer error vulnerability

The Tenda AC6 is a wireless router from the Chinese company Tenda. A stack overflow vulnerability exists in the Tenda AC6 SetVirtualServerCfg function, which can be exploited by an attacker to cause arbitrary command execution...

Tenda AC6 buffer error vulnerability

The Tenda AC6 is a wireless router from the Chinese company Tenda. A stack overflow vulnerability exists in the Tenda AC6 saveParentControlInfo function, which can be exploited by an attacker to potentially cause arbitrary command execution...

PT-2022-17635 · Unknown · Pfsense Ce +1

Name of the Vulnerable Software and Affected Versions: pfSense CE versions prior to 2.6.0 pfSense Plus versions prior to 22.01 Description: The issue is related to improper access control in pfSense CE and pfSense Plus, allowing a remote attacker with the privilege to change NTP GPS settings to...

Tenda AC9 buffer error vulnerability

Tenda AC9 is a wireless router from Tenda, China.Tenda AC9 version 15.03.2.21 is vulnerable to a buffer overflow vulnerability, which originates when the list parameter in the SetIpMacBind function does not properly validate data boundaries when performing operations on memory, and can be exploit...

CVE-2022-24770

"gradio" is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, "gradio" suffers from Improper Neutralization of Formula Elements in a CSV File. The "gradio" library has a flagging functionality which saves input/output data into a CSV fil...

CVE-2022-24770

The CVE-2022-24770 issue affects the Gradio library prior to version 2.8.11, in the flagging CSV export feature. The root cause is Improper Neutralization of Formula Elements in a CSV File, allowing arbitrary text (e.g., commands) to be saved into CSV outputs that may be opened by spreadsheet pro...

CVE-2022-24770: Improper Neutralization of Formula Elements in a CSV File

gradio is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, gradio suffers from Improper Neutralization of Formula Elements in a CSV File. The gradio library has a flagging functionality which saves input/output data into a CSV file on t...

Multiple ARRIS product command injection vulnerabilities

ARRIS SBR-AC1900P, SBR-AC3200P and SBR-AC1200P is a Wi-Fi router from ARRIS, Inc. Multiple ARRIS products are vulnerable to a command injection vulnerability, which stems from the DdnsUserName, DdnsHostName, and DdnsPassword parameters in the ddns function failing to properly filter the construct...

Multiple ARRIS Product Command Injection Vulnerabilities (CNVD-2022-68534)

ARRIS SBR-AC1900P, SBR-AC3200P and SBR-AC1200P is a Wi-Fi router from ARRIS USA. Multiple ARRIS products are vulnerable to a command injection vulnerability, which stems from the TimeZone parameter in the ntp function failing to properly filter the construct command special characters, commands,...

ARRIS TR3300 Command Injection Vulnerability (CNVD-2022-68529)

The ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS, Inc. A command injection vulnerability exists in the ARRIS TR3300, which stems from the failure of the wanipstat, wanmaskstat, wangwstat, and wandns1stat parameters in the ip function to properly filter the construct command special...

Multiple ARRIS Product Command Injection Vulnerabilities (CNVD-2022-68533)

ARRIS SBR-AC1900P, SBR-AC3200P and SBR-AC1200P is a Wi-Fi router from ARRIS, Inc. Multiple ARRIS products are vulnerable to a command injection vulnerability, which stems from the pppoeUserName, pppoePassword, and pppoeService parameters in the pppoe function failing to properly filter the...

ARRIS TR3300 Command Injection Vulnerability (CNVD-2022-68526)

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300, which stems from the failure of the htimezone parameter in the time zone function to properly filter the construct command special characters, commands, etc. The vulnerability can ...

ARRIS TR3300 Command Injection Vulnerability (CNVD-2022-68528)

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300, which stems from the pppoeusername, pppoepasswd, and pppoeservicename parameters in the pppoe function failing to properly filter the construct command special characters, commands...

ARRIS TR3300 Command Injection Vulnerability

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300, which stems from the failure of the hostname parameter in the dhcp function to properly filter the construct command special characters, commands, etc. An attacker could use this...

Multiple ARRIS Product Command Injection Vulnerabilities (CNVD-2022-68531)

ARRIS SBR-AC1900P, SBR-AC3200P and SBR-AC1200P is a Wi-Fi router from ARRIS USA. Multiple ARRIS products command injection vulnerability, which stems from the firewall local logging feature failing to properly filter constructed command special characters, commands, etc. An attacker could exploit...

CVE-2022-26993

Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pppoe function via the pppoeUserName, pppoePassword, and pppoeService parameters. This vulnerability allows attackers to execute arbitrary...

CVE-2022-26213

Totolink X5000RFirmware v9.1.0u.6118B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27005

CVE-2022-27005 affects Totolink X5000R (version 9.1.0u.6118_B20201102) and Totolink A7000R (version 9.1.0u.6115_B20201022). The Red Hat/PRION/CVE ecosystem entries describe a command-injection in the setWanCfg function via the hostName parameter, enabling arbitrary command execution through a cra...

CVE-2022-26207

Totolink devices Totolink A830R, A3100R, A950RG, A800R, A3000RU and A810R are affected by a command-injection in the function setDiagnosisCfg via the ipDoamin parameter. Successful exploitation could allow arbitrary command execution. The Red Hat/PRION/CPAI coverage consistently references the sa...