CVE-2024-51300

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the getrrd function...

CVE-2024-51300

The DrayTek Vigor3900 (version 1.5.1.3 ) is vulnerable to a command injection vulnerability (CWE-77). Attackers can inject malicious commands into the mainfunction.cgi endpoint and execute arbitrary commands by calling the get_rrd function. This vulnerability allows for high impact on confidentia...

CVE-2024-51296

The Draytek Vigor3900 router, specifically version 1.5.1.3 , is vulnerable to a command injection flaw (CWE-77) within the mainfunction.cgi component. An attacker can inject malicious commands and execute arbitrary code by calling the pingtrace function. Practical consequences include the executi...

CVE-2024-51299

The Draytek Vigor3900 router, specifically version 1.5.1.3 , is vulnerable to a command injection flaw. Attackers can inject malicious commands into the mainfunction.cgi component and execute arbitrary code by triggering the dumpSyslog function. Practical consequences include the ability for an a...

CVE-2024-51257

The DrayTek Vigor3900 router, specifically version 1.5.1.3 , is vulnerable to a command injection flaw. Attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by triggering the doCertificate function. This vulnerability (CWE-77) allows for unauthorized comman...

CVE-2024-51258

The DrayTek Vigor3900 router, specifically version 1.5.1.3 , contains a command injection vulnerability (CWE-77). Attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by invoking the doSSLTunnel function. This vulnerability allows for the execution of unaut...

CVE-2024-51298

The DrayTek Vigor3900 router, specifically version 1.5.1.3 , is vulnerable to a Code Injection (CWE-94) flaw. Attackers can inject malicious commands into mainfunction.cgi and achieve arbitrary command execution by calling the doGRETunnel function. This vulnerability allows for high impact on con...

CVE-2024-51301

The DrayTek Vigor3900 router, specifically version 1.5.1.3 , is vulnerable to a command injection flaw (CWE-77). Attackers can inject malicious commands into the mainfunction.cgi endpoint and execute arbitrary commands by invoking the packet_monitor function. The impact is categorized as HIGH sev...

CVE-2024-51257

DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function...

Cisco IOS XR Command Injection

The vulnerability of the command-line interface CLI of Cisco IOS XR operating systems is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands and increase their...

CVE-2024-51299

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function...

Exploit for OS Command Injection in Cyberpanel

CyberPanel Command Injection Vulnerability - CVE-2024-51378...

CVE-2024-51378

getresetstatus in dns/views.py and ftp/views.py in CyberPanel aka Cyber Panel before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware which is only for a POST request and using shell...

CVE-2024-41153

Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the web UI can execute commands on the device with root privileges, far more extensive than what the wri...

Advisory ROSA-SA-2024-2512

Software: python3-setuptools 39.2.0 OS: rosa-server79 packageevrstring: python3-setuptools-39.2.0-10.0.3.res7 CVE-ID: CVE-2024-37891 BDU-ID: 2023-02445 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the Python Packaging Authority package installation tools is related to insufficient input...

CVE-2024-22065

There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands...

CVE-2024-22065 ZTE MF258 Pro product has a OS Command injection vulnerability

There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands...

CVE-2024-22065: Improper Input Validation

There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands...

Nginx UI Arbitrary Command Execution

The vulnerability of the logrotate configuration in the Nginx UI server’s web interface is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary commands...

CVE-2024-51567

upgrademysqlstatus in databases/views.py in CyberPanel aka Cyber Panel before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware which is only for a POST request and using shell metacharacters in the...