Debian dla-3941 : libkpathsea-dev - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3941 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3941-1 [email protected]...

DLA-3941-1 texlive-bin - security update

Bulletin has no description...

CVE-2024-48074

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...

CVE-2024-48074

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...

CVE-2024-48074: Improper Neutralization of Special Elements used in an OS Command

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...

CVE-2024-26519: Missing Authentication for Critical Function

An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.cgi component...

MitraStar GPT-2541GNAC 操作系统命令注入漏洞

The MitraStar GPT-2541GNAC is a router from China-based MitraStar. The MitraStar GPT-2541GNAC suffers from an operating system command injection vulnerability that originates in the Firewall Settings Page component of /cgi-bin/settings-firewall.cgi that contains a command injection vulnerability...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2024-733)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-733 advisory. Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. CVE-2024-34155 Calling Decoder.Decode on a message which...

cgi-bin/mainfunction.cgi/cvmcfgupload Code Execution

The vulnerability of the cgi-bin/mainfunction.cgi/cvmcfgupload component of DrayTek Vigor routing software exists due to the failure to eliminate special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-46316: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 v1.5.1.6 was discovered to contain a command injection vulnerability via the sub2C920 function at /cgi-bin/mainfunction.cgi. This vulnerability allows attackers to execute arbitrary commands via supplying a crafted HTTP message...

CVE-2024-41586

A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to execute arbitrary code via a long query string to the cgi-bin/ipfedr.cgi component...

CVE-2024-41586: Stack-based Buffer Overflow

A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to execute arbitrary code via a long query string to the cgi-bin/ipfedr.cgi component...

PT-2024-7429 · Draytek · Draytek Vigor310

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor310 versions through 4.3.2.6 Description: The issue is related to a stack-based Buffer Overflow vulnerability in the /cgi-bin/ipfedr.cgi component of the DrayTek Vigor310 devices' web interface. This vulnerability can be exploite...

PT-2024-6631

Name of the Vulnerable Software and Affected Versions: TOTOLINK T10 version 4.1.8cu.5207 Description: A critical issue affects the setTracerouteCfg function of the file /cgi-bin/cstecgi.cgi, allowing remote attackers to execute arbitrary commands in the underlying operating system due to the...

CVE-2024-8956: Missing Authentication for Critical Function

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can...

Security Updates for Microsoft Office Online Server (September 2024)

The Microsoft Office Web Apps installation on the remote host is missing a security update. It is, therefore, affected by the following: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2024-43465 Note that Nessus has not tested for this iss...

PT-2024-31160

Name of the Vulnerable Software and Affected Versions COMFAST CF-XR11 version 2.7.2 Description The issue is a command injection vulnerability in the function sub 424CB4. Attackers can exploit this by sending POST request messages to the "/usr/bin/webmgnt" API endpoint and injecting commands into...

CVE-2024-44466: Improper Neutralization of Special Elements used in a Command

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub424CB4. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter iface...

CVE-2024-44466

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub424CB4. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter iface...

CVE-2024-8577

A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861B20230220/4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads to buffer overflow. T...