CVE-2024-22067

ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands...

CVE-2024-22067

The CVE-2024-22067 entry concerns the ZTE NH8091, where the Web module interface suffers improper permission control. An authenticated attacker could execute arbitrary commands due to insufficient access checks. The NVD reports a CVSSv3.1 base score of 8.8 (High) with network attack vector, low a...

CVE-2024-22067 ZTE NH8091 product has an improper permission control vulnerability

ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands...

CVE-2024-22067 ZTE NH8091 product has an improper permission control vulnerability

ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands...

CVE-2024-50848

An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file...

ZTE NH8091 安全漏洞

ZTE NH8091 is a modem from ZTE Corporation ZTE, China. A security vulnerability exists in the ZTE NH8091 V1.8 version, which originates from improper control of the Web module interface privileges and can be exploited by an authenticated attacker to execute arbitrary commands...

CVE-2024-50848

An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file...

CVE-2024-50848

CVE-2024-50848 : Multiple sources confirm an XML External Entity (XXE) vulnerability in the WorldServer v11.8.2 Import object and Translation Memory import features, exploitable by supplying a crafted .tmx file. Affected component: WorldServer 11.8.2; root cause: XXE allowing access to sensitive ...

Rakuten Turbo 5G 操作系统命令注入漏洞

The Rakuten Turbo 5G is a home router from Rakuten that requires no construction and plugs into a power outlet. An operating system command injection vulnerability exists in Rakuten Turbo 5G V1.3.18 and earlier versions, which stems from the presence of operating system command injection, where a...

The vulnerability of the SSH and Telnet protocol implementations of the D-Link DSL6740C modem’s microprogramming software allows a intruder to execute arbitrary commands.

The vulnerability of SSH and Telnet protocols implemented by the microprogramming software of the D-Link DSL6740C modem lies in the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute...

The vulnerability of the SmartFabric OS10 network operating system, related to the failure to sanitize input data at the control level, allows a perpetrator to execute arbitrary commands.

The vulnerability of the SmartFabric OS10 network operating system is related to the lack of measures taken to sanitize input data at the control level. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

CVE-2021-34752

A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands with root privileges on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of...

CVE-2021-1484

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to inject arbitrary commands on an affected system and cause a denial of service DoS condition. This vulnerability is due to improper input validation of user-supplied input to the device...

CVE-2023-20036

A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. This vulnerability is due to improper input validation when uploading a Device Pack. An...

CVE-2022-20655

A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this...

CVE-2022-20655

A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this...

CVE-2022-20655

A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this...

CVE-2024-11120

CVE-2024-11120 is a pre-auth OS Command Injection affecting certain GeoVision EOL devices. Unauthenticated remote attackers can inject/execute commands, with active exploitation observed in the wild (Mirai-related activity via the /DateSetting.cgi endpoint and szSrvIpAddr parameter). Mitigations ...

Dell SmartFabric OS10 Command Injection Vulnerability (CNVD-2025-02566)

Dell SmartFabric OS10 is a Debian Linux-based network operating system from Dell Networking designed to run on its PowerSwitch platform. A command injection vulnerability exists in Dell SmartFabric OS10 that stems from the system not filtering and validating user input at command execution. An...

The vulnerability of PostgreSQL database management system’s CREATE POLICY command for tables with row-level protection allows attackers to execute arbitrary commands.

The vulnerability of PostgreSQL database management system’s CREATE POLICY commands related to the lack of consistency between independent representations of the overall state. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary commands by repeatedly using...