12607 matches found
CVE-2024-48074
An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...
CVE-2024-48074
The DrayTek Vigor2960 router (version 1.4.4 ) is vulnerable to Remote Code Execution (RCE) due to the improper neutralization of special elements used in operating system commands. An attacker can inject a specially crafted command into the table parameter of the doPPPoE function located in the c...
CVE-2024-48074
An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...
CVE-2024-48074: Improper Neutralization of Special Elements used in an OS Command
An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...
CVE-2024-48074
An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...
genie_fix2.cgi Arbitrary Command Execution
The vulnerability of the geniefix2.cgi microprogramming software for NETGEAR EX6120 routers is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using the wandns1pri parameter...
CLSA-2024-1729628764 php: Fix of CVE-2024-8927
CVE-2024-8927: Fix bypass of cgi.forceredirect configuration...
CLSA-2024-1729628500 php: Fix of CVE-2024-8927
CVE-2024-8927: Fix bypass of cgi.forceredirect configuration...
CLSA-2024-1729627812 Fix CVE(s): CVE-2024-8927
SECURITY UPDATE: insecure configuration vulnerability - debian/patches/CVE-2024-8927.patch: fix bypass of cgi.forceredirect configuration - CVE-2024-8927...
CLSA-2024-1729626489 php: Fix of CVE-2024-8927
CVE-2024-8927: Fix bypass of cgi.forceredirect configuration...
D-Link DIR-878/DIR-882 Router Arbitrary Command Execution
The vulnerability of the SetPortForwardingSettings function in the prog.cgi script of D-Link DIR-878 and DIR-882 routers exists because measures to neutralize special elements used in operating system commands are not taken. Exploiting this vulnerability allows a malicious actor to execute...
D-Link DIR-878/DIR-882 SetVLANSettings Command Execution
The vulnerability of the SetVLANSettings function in the prog.cgi script of D-Link DIR-878 and DIR-882 routers exists due to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...
CVE-2024-26519: Missing Authentication for Critical Function
An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.cgi component...
Security update for php7
This update for php7 fixes the following issues: CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed bsc1231360 CVE-2024-8927: Fixed cgi.forceredirect configuration is bypassable due to an environment variable collision...
SUSE-SU-2024:3733-1 Security update for php7
This update for php7 fixes the following issues: - CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed bsc1231360 - CVE-2024-8927: Fixed cgi.forceredirect configuration is bypassable due to an environment variable...
Security update for php74
This update for php74 fixes the following issues: CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed bsc1231360 CVE-2024-8927: Fixed cgi.forceredirect configuration is bypassable due to an environment variable collision...
CLSA-2024-1729198655 php: Fix of 2 CVEs
CVE-2024-9026: Fix log tampering in PHP-FPM - CVE-2024-8927: Fix bypass of cgi.forceredirect configuration...
SUSE-SU-2024:3664-1 Security update for php8
This update for php8 fixes the following issues: - CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed bsc1231360 - CVE-2024-8927: Fixed cgi.forceredirect configuration is bypassable due to an environment variable...
MitraStar GPT-2541GNAC operating system command injection vulnerability
The MitraStar GPT-2541GNAC is a router from China-based MitraStar. The MitraStar GPT-2541GNAC suffers from an operating system command injection vulnerability that originates in the Firewall Settings Page component of /cgi-bin/settings-firewall.cgi that contains a command injection vulnerability...