CVE-2022-2487: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled.cgi. The manipulation of the argument starthour leads to os command injection. The exploit has been disclosed to the public and may be us...

CVE-2022-2486: Improper Neutralization of Special Elements used in an OS Command

A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade. The manipulation of the argument key leads to os command injection. The exploit has been disclosed to the public and may be used...

PT-2022-16933

Name of the Vulnerable Software and Affected Versions WAVLINK WN535K2 WAVLINK WN535K3 Description A critical issue was found in the file /cgi-bin/mesh.cgi?page=upgrade, where the manipulation of the key argument leads to os command injection. The exploit has been disclosed to the public and may b...

Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) Remote Root Exploit

Summary SpaceLogic C-Bus Home Automation System Lighting control and automation solutions for buildings of the future, part of SpaceLogic. SpaceLogic C-Bus is a powerful, fully integrated system that can control and automate lighting and many other electrical systems and products. The SpaceLogic...

CVE-2022-2488: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlistsync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been disclosed to the public and may be used...

PT-2022-16941

Name of the Vulnerable Software and Affected Versions WAVLINK WN535K2 WAVLINK WN535K3 Description A critical issue has been identified, affecting the /cgi-bin/nightled.cgi file. The manipulation of the start hour argument leads to os command injection. The exploit has been disclosed to the public...

CVE-2022-34540

Digital Watchdog DW MEGApix IP cameras A7.2.220211029 was discovered to contain a command injection vulnerability in the component /admin/vca/license/licensetok.cgi. This vulnerability is exploitable via a crafted POST request...

CVE-2022-2030

A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 throu...

CVE-2022-2030

CVE-2022-2030 describes an authenticated directory traversal in Zyxel firewall/USG/ZyWALL CGI programs. Affected products/versions include Zyxel USG FLEX 100(W) (4.50–5.30), USG FLEX 200 (4.50–5.30), USG FLEX 500 (4.50–5.30), USG FLEX 700 (4.50–5.30), USG FLEX 50(W) (4.16–5.30), USG20(W)-VPN (4.1...

Digital Watchdog DW MEGApix IP Cross-site Scripting Vulnerability

Digital Watchdog DW MEGApix IP is a camera from Digital Watchdog. A security vulnerability exists in Digital Watchdog DW MEGApix IP cameras version A7.2.220211029, which stems from a security issue in the component biaoneshot.cgi...

[SECURITY] Fedora 36 Update: php-8.1.8-1.fc36

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Dingtian DT-R002 2CH security vulnerabilities

The Dingtian DT-R002 2CH is a repeater device from Dingtian China. A security vulnerability exists in version 3.1.276A of the Dingtian DT-R002 2CH repeater device firmware, which stems from its relaycgi.cgi component that allows an attacker to replay HTTP post requests without authentication or a...

U.S. Dept Of Defense: an internel important paths disclosure [HtUS]

Summary: i found CGI script environment variable disclosure an important paths Steps To Reproduce: 1. visit this link : https://███ 2. look at poc pic you should restrict this quickly Impact this is so dangerous because attacker now know an internal paths and this juicy information as u can see i...

CVE-2022-32988: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in router Asus DSL-N14U-B1 1.1.2.3805 via the "list" parameters e.g. filterlwlist, keywordrulelist, etc in every ".asp" page containing a list of stored strings. The following asp files are affected: 1 cgi-bin/APPInstallation.asp, 2...

WAVLINK WN579 X3 Information Disclosure Vulnerability (CNVD-2022-61036)

The WAVLINK WN579 X3 is a wireless router from the Chinese company WAVLINK. An information disclosure vulnerability exists in WAVLINK WN579 X3 M79X3.V5030.180719 version, which originates from improper authorization management in /cgi-bin/ExportAllSettings.sh. An attacker can exploit this...

[SECURITY] Fedora 36 Update: php-8.1.7-1.fc36

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

CVE-2017-20049

A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely...

Design/Logic Flaw

A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely...

CVE-2017-20049

A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely...

CVE-2017-20049

Axis legacy network cameras (P3225, M3005) are affected by CVE-2017-20049 due to a flaw in an unspecified part of the CGI Script, causing improper privilege management. The vulnerability can be triggered remotely, enabling an attacker to exploit the issue without user interaction. No explicit roo...