CVE-2022-28496

CVE-2022-28496 affects TOTOLink outdoor CPE CP900 (version 6.3c.566_B20171026). A command injection vulnerability exists in the setPasswordCfg function exposed via the adminuser and adminpass parameters, allowing an attacker to execute arbitrary commands through a crafted request. The CVE entry n...

CVE-2022-28496

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adminpassparameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-28497

CVE-2022-28497 affects TOTOLink outdoor CPE CP900 (v6.3c.566_B20171026). The vulnerability is a command injection in the mtd_write_bootloader function exploitable via the filename parameter in crafted requests. The NVD entry indicates a high-severity impact (C/H/I/A all high) with network access,...

CVE-2022-28497

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 is discovered to contain a command injection vulnerability in the mtdwritebootloader function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

PT-2023-12943 · Totolink · Totolink Outdoor Cpe Cp900

Name of the Vulnerable Software and Affected Versions: TOTOLink outdoor CPE CP900 version 6.3c.566 B20171026 Description: The issue concerns a command injection vulnerability in the NTPSyncWithHost function via the host name parameter. This allows attackers to execute arbitrary commands via a...

CVE-2022-28494

The CVE-2022-28494 entry relates to TOTOLink outdoor CPE CP900 (version 6.3c.566_B20171026). A command injection flaw exists in the setUpgradeFW function reachable via the filename parameter, allowing an attacker to execute arbitrary commands through a crafted request. The NVD metrics indicate a ...

CVE-2022-28492

CVE-2022-28492 concerns TOTOLINK CPE devices (e.g., CP900) with firmware V6.3c.566 . The exposure described is a remote login authentication bypass, enabling an attacker to gain unauthorized access without user interaction. Reported metrics show a CRITICAL (3.1, base score 9.8) impact with networ...

CVE-2022-28491

The CVE-2022-28491 issue affects TOTOLink outdoor CPE CP900 (V6.3c.566_B20171026). It is a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter, allowing an attacker to execute arbitrary commands through a crafted request. CVSS 3.1 base score is 9.8 (CRITICA...

RHEL 8 : nss (RHSA-2023:1436)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1436 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

Zyxel Unauthenticated LAN Remote Code Execution Exploit

This Metasploit module exploits a buffer overflow in the zhttpd binary /bin/zhttpd. It is present on more than 40 Zyxel routers and CPE devices. The code execution vulnerability can only be exploited by an attacker if the zhttp webserver is reachable. No authentication is required. After...

Fedora 37 : firefox (2023-24b2b22eca)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-24b2b22eca advisory. - Update to latest upstream 111.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CBL Mariner 2.0 Security Update: kernel (CVE-2022-3105)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3105 advisory. - An issue was discovered in the Linux kernel through 5.16-rc6. uapifinalize in...

SUSE SLES12 Security Update : libX11 (SUSE-SU-2023:0667-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0667-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. File data...

WordPress WPCode - Insert Headers and Footers Plugin < 2.0.7 Improper Authorization Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpcode:wpcode"; ifdescription...

XWiki 7.1-milestone-1 < 14.0 Uncontrolled Resource Consumption Vulnerability (GHSA-92wp-r7hm-42g7)

Xwiki is prone to an uncontrolled resource consumption vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki...

The vulnerability of Zyxel 5G NR/4G LTE CPE router’s micro-programming software arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows a hacker to execute arbitrary commands.

The vulnerability of Zyxel 5G NR/4G LTE CPE routers’ microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using a speciall...

Node.js 14.x < 14.21.3, 16.x < 16.19.1, 18.x < 18.14.1, 19.x < 19.6.1 Multiple Vulnerabilities - Windows

Node.js is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodejs:node.js"; ifdescription...

Node.js 16.x < 16.19.1, 18.x < 18.14.1, 19.x < 19.6.1 Multiple Vulnerabilities - Mac OS X

Node.js is prone to multiple vulnerabilities. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

WordPress Popup Maker Plugin < 1.16.11 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:code-atlantic:popupmaker"; ifdescription...

Nextcloud Server < 23.0.12, 24.x < 24.0.8, 25.x < 25.0.2 Path Traversal Vulnerability (GHSA-273v-9h7x-p68v)

Nextcloud Server is prone to a path traversal vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...