CVE-2024-48637

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...

CVE-2024-48634

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...

CVE-2024-48633: Improper Neutralization of Special Elements used in an OS Command

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, InternalPort, ProtocolNumber, and LocalIPAddress parameters in the SetVirtualServerSettings function. This vulnerability allows attackers to execute arbitrar...

CVE-2024-48629: Improper Neutralization of Special Elements used in an OS Command

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the IPAddress parameter in the SetGuestZoneRouterSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...

CVE-2024-48634

D-Link DIR-882 (dual-band wireless router) and DIR-878 (wireless router) devices are susceptible to a command injection vulnerability. The flaw exists within the SetWlanRadioSecurity() function in the prog.cgi script of the router's microprogramming software. It is caused by a failure to neutrali...

CVE-2024-48636

The D-Link DIR-882 (dual-band wireless router) and DIR-878 (wireless router) are vulnerable to a command injection vulnerability in the SetVLANSettings function. The root cause is the failure to neutralize special elements used in operating system commands, specifically within the VLANID:0/VID pa...

CVE-2024-48631

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...

CVE-2024-48629

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the IPAddress parameter in the SetGuestZoneRouterSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...

CVE-2024-48631: Improper Neutralization of Special Elements used in an OS Command

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...

CVE-2024-35783

CVE-2024-35783 affects Siemens SIMATIC SCADA/PCS7 family (e.g., SIMATIC BATCH, Information Server, PCS 7, Process Historian, WinCC variants). The root cause is privilege-management errors allowing the database server to run with elevated privileges, enabling an authenticated attacker to execute a...

CVE-2024-43386 Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in mGuard devices.

A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAILNOTIFICATION.TO in mGuard devices...

CVE-2024-43386

CVE-2024-43386 affects Phoenix Contact mGuard devices (including FL/TC MGUARD) where a low-privileged remote attacker can trigger OS command execution as root via improper neutralization of elements in the EMAIL_NOTIFICATION.TO variable. The issue is rooted in input handling of that field, enabli...

CVE-2024-43386 Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in mGuard devices.

A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAILNOTIFICATION.TO in mGuard devices...

CVE-2024-43385

CVE-2024-43385 affects PHOENIX CONTACT mGuard devices. The vulnerability stems from improper neutralization of a special element in the PROXY_HTTP_PORT variable, enabling a low-privileged remote attacker to trigger arbitrary OS command execution as root. Documents identify the affected component ...

CVE-2024-35783: Execution with Unnecessary Privileges

A vulnerability has been identified in SIMATIC BATCH V9.1 All versions, SIMATIC Information Server 2020 All versions V2020 SP2 Update 5, SIMATIC Information Server 2022 All versions V2022 SP1 Update 2, SIMATIC PCS 7 V9.1 All versions V9.1 SP2 UC06, SIMATIC Process Historian 2020 All versions V202...

CVE-2024-21881: Inadequate Encryption Strength

Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x...

CVE-2024-40895

FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execute arbitrary OS commands when certain conditions are met in an environment where the notification program setting is enabled and the...

CVE-2024-40895

The management console FFRI AMC (versions 3.4.0 to 3.5.3), along with certain OEM products by NEC Corporation and Sky Co., Ltd. , is vulnerable to an OS command injection (CWE-78). The flaw is triggered when the notification program setting is enabled and the executable file path is configured to...

CVE-2024-40895

FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execute arbitrary OS commands when certain conditions are met in an environment where the notification program setting is enabled and the...

CVE-2024-5670

The web services of Softnext's products, Mail SQR Expert and Mail Archiving Expert do not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the remote server...