CVE-2023-3305 C-DATA Web Management System User Creation access control

A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin/jumpto.php?class=user&page=configsave&isphp=1 of the component User Creation Handler. The manipulation of the argument user/newpassword...

CVE-2023-3305

CVE-2023-3305 affects C-DATA Web Management System (up to 20230607), specifically the User Creation Handler component. The vulnerability lies in the file /cgi-bin/jumpto.php?class=user&page=config_save&isphp=1 where manipulating the user/newpassword parameter grants improper access control. It al...

C-DATA Web Management System 访问控制错误漏洞

C-DATA Web Management System is a web management system from China-based C-DATA Corporation. An access control error vulnerability exists in C-DATA Web Management System version 20230607 and earlier, which stems from a problem with the file /cgi-bin/jumpto.php?class=user&page=configsave&isphp=1,...

PT-2023-5239 · Unknown · C-Data Web Management System

Name of the Vulnerable Software and Affected Versions: C-DATA Web Management System up to 20230607 Description: A critical issue affects the User Creation Handler component of the C-DATA Web Management System, specifically the file /cgi-bin/jumpto.php?class=user&page=config save&isphp=1. The...

VulnCheck KEV: CVE-2022-4257

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...

Silence is golden partner for Truebot and Clop ransomware

A recent rise in the number of Truebot infections has been attributed to a threat actor known as the Silence Group. The Silence Group is an initial access broker IAB that frequently changes tools and tactics to stay on top of the game. An IAB's primary task is to find a weakness or vulnerability,...

CVE-2022-4257

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...

Design/Logic Flaw

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...

CVE-2022-4257 C-DATA Web Management System GET Parameter jumpto.php argument injection

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...

CVE-2022-4257

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...

PT-2022-26501 · Unknown · C-Data Web Management System

Name of the Vulnerable Software and Affected Versions: C-DATA Web Management System affected versions not specified Description: A critical issue affects the C-DATA Web Management System, specifically the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the...

CVE-2022-4257 C-DATA Web Management System GET Parameter jumpto.php argument injection

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...

CVE-2022-4257

C-DATA Web Management System contains a vulnerability in the GET Parameter Handler’s cgi-bin/jumpto.php where manipulating the hostname argument leads to argument injection. The issue can be exploited remotely and an exploit has been disclosed publicly. Affected component/file: cgi-bin/jumpto.php...

C-DATA Web Management System 操作系统命令注入漏洞

C-DATA Web Management System is a web management system from the Chinese company C-DATA. The C-DATA Web Management System suffers from an operating system command injection vulnerability that stems from a problem with the unknown handling of the cgi-bin/jumpto.php file in the component GET...

C-DATA Command Injection (CVE-2022-29337)

A command injection vulnerability exists in C-DATA. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2022-29337

C-DATA FD702XW-X-R430 v2.1.13X001 was discovered to contain a command injection vulnerability via the vacmd parameter in formlanipv6. This vulnerability allows attackers to execute arbitrary commands via a crafted HTTP request...

CVE-2022-29337

C-DATA FD702XW-X-R430 v2.1.13X001 was discovered to contain a command injection vulnerability via the vacmd parameter in formlanipv6. This vulnerability allows attackers to execute arbitrary commands via a crafted HTTP request...

Command injection

C-DATA FD702XW-X-R430 v2.1.13X001 was discovered to contain a command injection vulnerability via the vacmd parameter in formlanipv6. This vulnerability allows attackers to execute arbitrary commands via a crafted HTTP request...

CVE-2022-29337

C-DATA FD702XW-X-R430 router, version 2.1.13_X001, contains an OS command injection via the va_cmd parameter in formlanipv6. Exploitation allows arbitrary command execution through a crafted HTTP request, with high/severe impact (network access, no auth) per CVSS data. Some advisories note to res...

CVE-2022-29337

C-DATA FD702XW-X-R430 v2.1.13X001 was discovered to contain a command injection vulnerability via the vacmd parameter in formlanipv6. This vulnerability allows attackers to execute arbitrary commands via a crafted HTTP request...