CVE-2018-8062

CVE-2018-8062 Comtrend AR-5387un ルーターにおける永続的XSS 悪用方法: この脆弱性を悪用するには、ルーターにログインした後、WANサービスを作成する必要があります 「Advanced Setup」、「WAN Service」をクリックし、「Add button」、「Next」と進めます 次に、「Enter Service Description」フィールドにペイロードを挿入します。PoCではこれを使用しました その後、「Next」を4回クリックしてステップを進め、最後に「Apply/Save」をクリックします...

scripts-nse

What is it? 一些用于从路由器搜索信息的 NSE 脚本。 这些脚本的作者是 VicenDominguez。他发现了华为的 0-Day 漏洞，我只将其修改用于另外两款设备。 该脚本的作者不对其使用负责。 Huawei HG253s v2 Vodafone-Spain 开始向西班牙客户出租新款华为 HG253v2 路由器。这款新路由器配备了新的固件版本。 漏洞 基本上，它没有验证某些管理网页中的会话 cookie。 因此，可以从未经认证的互联网开放路由器的这些 URL 直接获取信息。 http://IPhtml253s/api/ntwk/WlanBasic...

CVE-2019-25483

Comtrend AR-5310 GE31-412SSG-C01R10.A2pG039u.d24k contains a restricted shell escape vulnerability that allows local users to bypass command restrictions by using the command substitution operator $ . Attackers can inject arbitrary commands through the $ syntax when passed as arguments to allowed...

EUVD-2019-19761

Comtrend AR-5310 GE31-412SSG-C01R10.A2pG039u.d24k contains a restricted shell escape vulnerability that allows local users to bypass command restrictions by using the command substitution operator $ . Attackers can inject arbitrary commands through the $ syntax when passed as arguments to allowed...

CVE-2019-25483

Comtrend AR-5310 GE31-412SSG-C01R10.A2pG039u.d24k contains a restricted shell escape vulnerability that allows local users to bypass command restrictions by using the command substitution operator $ . Attackers can inject arbitrary commands through the $ syntax when passed as arguments to allowed...

CVE-2019-25483

Comtrend AR-5310 GE31-412SSG-C01R10.A2pG039u.d24k contains a restricted shell escape vulnerability that allows local users to bypass command restrictions by using the command substitution operator $ . Attackers can inject arbitrary commands through the $ syntax when passed as arguments to allowed...

CVE-2019-25483 Comtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k Restricted Shell Escape

Comtrend AR-5310 GE31-412SSG-C01R10.A2pG039u.d24k contains a restricted shell escape vulnerability that allows local users to bypass command restrictions by using the command substitution operator $ . Attackers can inject arbitrary commands through the $ syntax when passed as arguments to allowed...

CVE-2019-25483

The CVE-2019-25483 entry concerns the Comtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k device, where a restricted shell escape vulnerability allows local users to bypass command restrictions via the command substitution operator $( ). Attackers can inject arbitrary commands through $( ) when pa...

Comtrend AR-5310 安全漏洞

The Comtrend AR-5310 is a wireless router device produced by the Comtrend company in the United States. The Comtrend AR-5310 GE31-412SSG-C01R10.A2pG039u.d24k version contains a security vulnerability. This vulnerability stems from command substitution bypasses in the restricted shell, which may...

CVE-2019-25483: Missing Authentication for Critical Function

Comtrend AR-5310 GE31-412SSG-C01R10.A2pG039u.d24k contains a restricted shell escape vulnerability that allows local users to bypass command restrictions by using the command substitution operator $ . Attackers can inject arbitrary commands through the $ syntax when passed as arguments to allowed...

PT-2026-24777

Comtrend AR-5310 GE31-412SSG-C01 R10.A2pG039u.d24k contains a restricted shell escape vulnerability that allows local users to bypass command restrictions by using the command substitution operator $ . Attackers can inject arbitrary commands through the $ syntax when passed as arguments to allowe...

CVE-2010-0470

Cross-site scripting XSS vulnerability in scvrtsrv.cmd in Comtrend CT-507IT ADSL Router allows remote attackers to inject arbitrary web script or HTML via the srvName parameter...

EUVD-2018-19744

Malware in sbrugna...

EUVD-2018-12946

Malware in sbrugna...

EUVD-2010-0501

Malware in sbrugna...

EUVD-2024-46937

Malicious code in bioql PyPI...

EUVD-2024-46936

Malicious code in bioql PyPI...

CVE-2020-10173

Comtrend VR-3033 DE11-416SSG-C01R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and traceroute diagnostic pages, as demonstrated by shell metacharacters in the pingIpAddress parameter to ping.cgi...

CVE-2018-20388

Comtrend CM-6200un 123.447.007 and CM-6300n 123.553mp1.005 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests...

CVE-2018-8062

A cross-site scripting XSS vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04R02.A2pD035g.d23i firmware allows remote attackers to inject arbitrary web script or HTML via the Service Description parameter while creating a WAN service...