511 matches found
CVE-2024-44844
DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the runcommand function...
CVE-2024-44844
CVE-2024-44844 affects DrayTek Vigor3900 v1.5.1.6. An authenticated command injection vulnerability exists in the run_command function through the name parameter, enabling arbitrary commands with low privileges required and no user interaction. Impact is high on confidentiality, integrity, and av...
CVE-2024-44845
DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filterstring function...
CVE-2024-37023
Multiple OS command injection vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an authenticated remote attacker to execute arbitrary OS commands via various endpoint parameters...
CVE-2024-21881
CVE-2024-21881 affects Envoy 4.x through 5.x. The vulnerability is an Inadequate Encryption Strength issue that allows an authenticated attacker to execute arbitrary OS commands via encrypted package upload. Connected documents confirm affected software and the underlying issue, and indicate ther...
CVE-2024-21881 Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x
Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x...
mySCADA MyPRO Authenticated Command Injection
class MetasploitModule 'mySCADA MyPRO Authenticated Command Injection CVE-2023-28384', 'Description' = %q Authenticated Command Injection in MyPRO MSFLICENSE, 'Author' = 'Michael Heinzl', Vulnerability discovery & MSF module 'References' = 'URL',...
Hewlett Packard Enterprise EdgeConnect SD-WAN 安全漏洞
Hewlett Packard Enterprise EdgeConnect SD-WAN is Hewlett Packard Enterprise's secure network foundation for Zero Trust and SASE. It includes best-in-class SD-WAN and next-generation firewalls that deliver unrivaled quality of experience and advanced security. A security vulnerability exists in...
PT-2024-29289 · Hewlett Packard · Hpe Aruba Networking Edgeconnect Sd-Wan
Name of the Vulnerable Software and Affected Versions: HPE Aruba Networking EdgeConnect SD-WAN gateways affected versions not specified Description: An authenticated command injection issue exists in the Command Line Interface of the affected software. This allows for the execution of arbitrary...
PT-2024-10143 · Wavlink · Wavlink Ac3000
Name of the Vulnerable Software and Affected Versions: Wavlink AC3000 M33A8.V5030.210505 Description: Multiple OS command injection vulnerabilities exist in the set add routing functionality of the internet.cgi script. A specially crafted HTTP request can lead to arbitrary command execution. An...
CVE-2024-4640
CVE-2024-4640 affects MOXA OnCell G3470A-LTE Series, firmware v1.7.7 and earlier. The issue is missing bounds checking on buffer operations, allowing an attacker to write past allocated buffer boundaries, causing a program crash (DoS). Connected sources reiterate a buffer overflow risk but do not...
CVE-2024-4640 OnCell G3470A-LTE Series: Authenticated Command Injection via sendTestEmail
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to missing bounds checking on buffer operations. An attacker could write past the boundaries of allocated buffer regions in memory, causing a program crash...
CVE-2024-4639
CVE-2024-4639 affects MOXA OnCell G3470A-LTE Series firmware v1.7.7 and earlier. The root cause is a lack of neutralized inputs in IPSec configuration, enabling an attacker to modify the intended commands sent to target functions and potentially execute unauthorized commands. Connected sources co...
CVE-2024-4638 OnCell G3470A-LTE Series: Authenticated Command Injection via webUploadKey
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in the web key upload function. An attacker could modify the intended commands sent to target functions, which could cause malicious users to execute unauthorized...
ORing IAP-420 2.01e Cross Site Scripting / Command Injection Vulnerabilities
------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| ORing IAP-420 vulnerable version| 2.01e fixed version| - CVE number| CVE-2024-5410, CVE-2024-5411 impact| High homepage| https://oringnet.com/ found| 2024-01-19 by| T. Weber...
CVE-2024-5411
Missing input validation and OS command integration of the input in the ORing IAP-420 web-interface allows authenticated command injection.This issue affects IAP-420 version 2.01e and below...
VulnCheck KEV: CVE-2024-3272
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution...
PT-2024-2011 · Qnap · Qts +2
Name of the Vulnerable Software and Affected Versions: QTS versions prior to 5.1.3.2578 build 20231110 QuTS hero versions prior to h5.1.3.2578 build 20231110 QuTScloud versions prior to c5.1.5.2651 Description: An injection vulnerability has been reported to affect several QNAP operating system...
CVE-2024-25611
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...