1885 matches found
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2017-3506 Oracle WebLogic Server OS Command Injection Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose...
Tenda FH1206 mac parameter command injection vulnerability
The Tenda FH1206 is a wireless router from Tenda China. The Tenda FH1206 suffers from a command injection vulnerability, which originates from the mac parameter of ip/goform/WriteFacMac failing to correctly filter constructed command special characters, commands, etc. The vulnerability can be...
CVE-2024-35401
TOTOLINK CP900L v4.1.5cu.798B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function...
CVE-2024-35401
TOTOLINK CP900L v4.1.5cu.798B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function...
CVE-2024-35340
Tenda FH1206 V1.2.0.88155 was discovered to contain a command injection vulnerability via the cmdinput parameter at ip/goform/formexeCommand...
CVE-2024-35339
Tenda FH1206 V1.2.0.88155 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac...
TOTOLINK CPE CP450 CloudACMunualUpdate Method Command Injection Vulnerability
TOTOLINK CPE CP450 is an outdoor wireless client terminal device from China Gion Electronics TOTOLINK, which is mainly used to provide wireless broadband access services, especially for wireless network coverage in rural or remote areas. A command injection vulnerability exists in the TOTOLINK CP...
TOTOLINK CPE CP450 setWebWlanIdx Method Command Injection Vulnerability
TOTOLINK CPE CP450 is an outdoor wireless client terminal device manufactured by China Gion Electronics TOTOLINK. The TOTOLINK CPE CP450 suffers from a command injection vulnerability that stems from the webWlanIdx parameter of the setWebWlanIdx method failing to correctly filter constructed...
TOTOLINK X5000R timeout parameter command injection vulnerability
The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X5000R timeout parameter, which originates from the failure of the timeout parameter of /cgi-bin/cstecgi.cgi to properly filter constructed command special characters,...
CVE-2024-3126
CVE-2024-3126 concerns the parisneo/lollms-webui project, specifically the bug in the Python file lollms_xtts.py and the function run_xtts_api_server. The issue stems from constructing an OS command with a Python f-string and passing xtts_base_url to subprocess.Popen without adequate input saniti...
CVE-2024-28136
A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service...
CVE-2024-32355
TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain a command injection vulnerability via the 'password' parameter in the setSSServer function...
CVE-2024-32353
CVE-2024-32353 affects TOTOLINK X5000R firmware version 9.1.0cu.2350_B20230313. A command injection exists in the setSSServer API at /cgi-bin/cstecgi.cgi via the port parameter, caused by inadequate input filtering of command characters. Impact is high (arbitrary command execution) with CVSSv3.1:...
Aruba Networks ArubaOS 和 InstantOS 安全漏洞
Aruba Networks ArubaOS and Aruba Networks InstantOS are both products of Aruba Networks, Inc.Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks, including Mobility Controllers and Mobility Access Switches. Aruba Networks InstantOS is an Arch Linux-based distribution...
GE HealthCare ultrasound devices 操作系统命令注入漏洞
GE General Electric Healthcare Ultrasound is a medical sonic detection device from General Electric GE. An operating system command injection vulnerability exists in GE HealthCare ultrasound devices, which stems from the presence of an operating system command injection vulnerability...
PT-2024-24109 · Hewlett Packard +1 · Aos-8 Instant/Aos-10 Ap +4
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities results i...
PT-2024-24105 · Aruba · Aruba Access Point
Name of the Vulnerable Software and Affected Versions: Aruba Access Point affected versions not specified Description: The issue is related to a command injection vulnerability in the deauthentication service. This could lead to unauthenticated remote code execution by sending specially crafted...
PT-2024-24103 · Aruba · Aruba Central Communications Service
Name of the Vulnerable Software and Affected Versions: Aruba Central Communications service affected versions not specified Description: The issue is related to a command injection vulnerability in the Central Communications service. This vulnerability could lead to unauthenticated remote code...