1885 matches found
CVE-2023-42664
A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTT...
CVE-2024-22107
An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method systemSettingsDnsDataAction at /opt/webapp/src/AppBundle/Controller/React/SystemSettingsController.php is vulnerable to command injection via the /old/react/v1/api/system/dns/data endpoint. An authenticated attacker can...
CVE-2023-47566 QTS, QuTS hero, QuTScloud
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645...
TOTOLINK A3300R setWiFiAclRules method command injection vulnerability
TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R version V17.0.0cu.557B20221024, which stems from the desc parameter of the setWiFiAclRules method failing to correctly filter the construct command special...
CVE-2024-24327
TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIpv6Cfg function...
CVE-2024-24325
TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParentalRules function...
PT-2024-20363 · Totolink · Totolink A3300R
Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: The issue is related to a command injection vulnerability. This vulnerability can be exploited via the port or enable parameters in the setRemoteCfg function. Recommendations: For...
CVE-2024-24332
TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function...
TRENDnet TEW-815DAP Command Injection Vulnerability
The TRENDnet TEW-815DAP is a wireless access point from Trendnet, Inc. A command injection vulnerability exists in the TRENDnet TEW-815DAP version 1.0.2.0, which stems from the fact that incorrect operation of the parameters NtpDstStart/NtpDstEnd can lead to command injection...
PT-2024-5052 · Netis Systems · Netis Systems Mw5360
Name of the Vulnerable Software and Affected Versions: NETIS SYSTEMS MW5360 version 1.0.1.3031 Description: The issue is related to a command injection vulnerability via the password parameter on the login page. This vulnerability may allow a remote attacker to execute arbitrary commands...
CVE-2024-22663
The CVE-2024-22663 entry documents a command injection vulnerability in TOTOLINK A3700R devices, triggered via the setOpModeCfg function. Affected software is TOTOLINK A3700R with firmware version 9.1.2u.6165 (build 20211012). The issue allows arbitrary command execution, with high impact to conf...
TOTOLINK A3700R NTPSyncWithHost Method Command Injection Vulnerability
The TOTOLINK A3700R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in TOTOLINK A3700R v9.1.2u.5822B20200513, which stems from the NTPSyncWithHost method failing to properly filter construct command special characters, commands, and so on. An...
TOTOLINK A3300R setNtpCfg Method Command Injection Vulnerability
TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R version V17.0.0cu.557B20221024, which stems from the tz parameter of the setNtpCfg method failing to correctly filter construct command special characters,...
Command Injection Vulnerability in DIR-822+ V1.0.2 of AUO Electronic Equipment (Shanghai) Co.
DIR-822 is a wireless router from D-Link, a Chinese company. A command injection vulnerability exists in the AUO Electronic Devices Shanghai Co. DIR-822+ version V1.0.2, which stems from the SetStaticRouteSettings function failing to correctly filter constructor command special characters,...
MGASA-2024-0010 Updated openssh packages fix security vulnerabilities
The updated packages fix security vulnerabilities: The PKCS11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. CVE-2023-38408 Prefix Truncation Attacks in SSH...
DEBIAN-CVE-2023-51698
Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This vulnerability gives the attacker immediate access to the target system when the target user opens a crafted document or clicks on a crafted link/URL using a maliciously crafted CB...
CVE-2023-51698
Atril (the Atril document viewer) is vulnerable to a critical Command Injection vulnerability (CVE-2023-51698). A crafted CBT document packaged as a TAR archive can allow an attacker to execute arbitrary commands when opened or when a user clicks a crafted link, potentially giving immediate acces...
Ivanti Releases Security Update for Connect Secure and Policy Secure Gateways
Ivanti has released a security updatelink is external to address an authentication bypass vulnerability CVE-2023-46805link is external and a command injection vulnerability CVE-2024-21887link is external in all supported versions 9.x and 22.x of Connect Secure and Policy Secure gateways. A cyber...