Command injection

ASUS RT-AC86U AiProtection security- related function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

CVE-2023-39237 ASUS RT-AC86U - Command injection vulnerability - 5

ASUS RT-AC86U Traffic Analyzer - Apps analysis function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

CVE-2023-39236

ASUS RT-AC86U Traffic Analyzer - Statistic function is vulnerable to command injection due to insufficient filtering of special characters. A remote attacker with regular user privileges can trigger arbitrary command execution, potentially corrupting the system or stopping services. Affected prod...

CVE-2023-38033 ASUS RT-AC86U - Command injection vulnerability - 3

ASUS RT-AC86U unused Traffic Analyzer legacy Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

CVE-2023-38033 ASUS RT-AC86U - Command injection vulnerability - 3

ASUS RT-AC86U unused Traffic Analyzer legacy Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

CVE-2023-38032 ASUS RT-AC86U - Command injection vulnerability - 2

ASUS RT-AC86U AiProtection security- related function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

CVE-2023-38032

CVE-2023-38032 affects the ASUS RT-AC86U router’s AiProtection security-related function. The root cause is insufficient filtering of special characters, enabling a remote attacker with regular user privileges to perform a command injection and execute arbitrary commands, potentially disrupting t...

CVE-2023-38031

ASUS RT-AC86U Adaptive QoS - Web History function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

Potential Out of Bound Error When Accessing Range Array

Lines of code Vulnerability details The code seems to be attempting to access an element of the 'ranges' array using an index calculated from the array's length minus one. However, during the deployment or initialization of the contract, if the length of 'ranges' is 1, this calculation results in...

The vulnerability of the TIFFReadDirectory function in the LibTIFF library, which allows a hacker to cause a service failure.

The vulnerability of the TIFFReadDirectory function in the LibTIFF library is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Malicious users can manipulate the withdrawRound to withdraw their stake before the unbonding period is over.

Lines of code Vulnerability details Impact Disruption the normal bonding incentives and mechanisms in the protocol. Validators or transcoders could withdrew unexpectedly, preventing governance responses to bonded token changes. Proof of Concept The withdrawStake function first checks if the...

The vulnerability of the formSetDeviceName() function in the Tenda AC8 router’s microprogramming software allows a hacker to execute arbitrary code, increase their privileges, or cause service failures.

The vulnerability of the formSetDeviceName function in the Tenda AC8 router’s microprogramming software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code, gain elevated privileges, or cause...

Vulnerability of the gdi_CreateSurface() function in RDP clients of FreeRDP, allowing attackers to cause service interruptions

The vulnerability of the gdiCreateSurface function in the RDP client FreeRDP is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

PT-2023-7491 · Asus · Asus Rt-Ac86U

Name of the Vulnerable Software and Affected Versions: ASUS RT-AC86U affected versions not specified Description: The issue exists due to insufficient filtering of special characters in the Traffic Analyzer - Statistic function of the ASUS RT-AC86U Wi-Fi router's firmware. A remote attacker with...

The vulnerability of the GetParentControlInfo() function in Tenda AC9 and Tenda AC5 router microprogramming software allows a hacker to execute arbitrary code or cause service failures.

The vulnerability of the GetParentControlInfo function in Tenda AC9 and Tenda AC5 routers is related to the issue where an operation exceeds the buffer boundaries in memory when processing the mac parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause...

Vulnerability of the progressive_decompress() function in the RDP client FreeRDP, allowing a hacker to trigger a service failure

The vulnerability of the progressivedecompress function in the RDP client FreeRDP is related to the occurrence of operations outside the buffer in memory when processing nXSrc and nYSrc. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

PT-2023-26259 · Ivanti · Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche Manager versions prior to 6.4.1 Description: A security vulnerability within Ivanti Avalanche Manager may allow an unauthenticated attacker to create a buffer overflow, potentially leading to service disruption or arbitrary...

The vulnerability of the /goform/SetIpMacBind component in the Tenda AC10 router software allows a attacker to cause a service failure or execute arbitrary code.

The vulnerability of the /goform/SetIpMacBind component in the Tenda AC10 router software lies in the ability to write data beyond the buffer in memory. Exploiting this vulnerability could allow a remote attacker to cause service failures or execute arbitrary code...

The vulnerability of the BigDecimal component in the Apache Johnzon JSON file processing software allows a attacker to cause a service failure.

The vulnerability of the BigDecimal component in the Apache Johnzon JSON processing software lies in the shortcomings of the deserialization mechanism when processing JSON files. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

The vulnerability of the /goform/SetIpMacBind component in the Tenda AC8 router software allows a attacker to cause a service failure or execute arbitrary code.

The vulnerability of the /goform/SetIpMacBind component in Tenda AC8 software lies in the possibility of writing data outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to cause service failures or execute arbitrary code...