D-Link DAR-7000 操作系统命令注入漏洞

D-Link DAR-7000 is an Internet Behavior Audit Gateway from China AUO D-Link. An OS command injection vulnerability exists in the D-Link DAR-7000 20240912 and earlier versions, which stems from the parameter host in the file /view/DBManage/BackupServercommit.php that can lead to OS command...

CVE-2024-7312 REST Interface Link Redirection via Host parameter

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Payara Platform Payara Server REST Management Interface modules allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5, from 5.20.0 before...

CVE-2024-7312 REST Interface Link Redirection via Host parameter

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Payara Platform Payara Server REST Management Interface modules allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5, from 5.20.0 before...

Vulnerability fixed in Zyxel Access Points and Secure Routers

Zyxel has fixed a vulnerability in several types of Access Points and Secure Routers. The vulnerability is in the way the cgi system processes the 'host' parameter and allows a malicious person to execute OS-level commands. For successful exploitation, the malicious party must have access to the...

CVE-2024-7261

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70ABVT.4 and earlier, WAC500 firmware version 6.70ABVS.4 and earlier, WAX655E firmware version 7.00ACDO.1 and earlier, WBE530 firmware version 7.00ACLE.1 and earlier,...

CVE-2024-42547

TOTOLINK A3100R V4.1.2cu.5050B20200504 has a buffer overflow vulnerability in the httphost parameter in the loginauth function...

CVE-2024-42543

TOTOLINK A3700R v9.1.2u.5822B20200513 has a buffer overflow vulnerability in the httphost parameter in the loginauth function...

Edimax IC-6220DC和Edimax IC-5150W 命令注入漏洞

Edimax IC-6220DC and Edimax IC-5150W are both smart wireless cameras from China Xunzhou Edimax. Command injection vulnerability exists in Edimax IC-6220DC and Edimax IC-5150W version 3.06 and earlier, which stems from the parameter host of the function cgiFormString in the file ipcamcgi, which ca...

The vulnerability of the loginauth (/cgi-bin/cstecgi.cgi) function in the TOTOLINK EX200 router software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the loginauth /cgi-bin/cstecgi.cgi function in the TOTOLINK EX200 router software arises due to buffer overflows in the stack during the processing of the httphost parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the loginauth (/cgi-bin/cstecgi.cgi) function in the TOTOLINK EX1200L router’s microprogramming system allows a intruder to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the loginauth /cgi-bin/cstecgi.cgi function in the TOTOLINK EX1200L router software arises due to buffer overflows in the stack during the processing of the httphost parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the getSaveConfig function (/cgi-bin/cstecgi.cgi?action=save&setting) in the TOTOLINK EX200 router software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the getSaveConfig function /cgi-bin/cstecgi.cgi?action=save&setting in the TOTOLINK EX200 router software arises due to a buffer overflow occurring during the processing of the httphost parameter. Exploiting this vulnerability allows an attacker to compromise the...

PT-2024-38453 · Edimax · Edimax Ic-6220Dc +1

Name of the Vulnerable Software and Affected Versions: Edimax IC-6220DC and IC-5150W versions up to 3.06 Description: A critical issue affects the cgiFormString function of the ipcam cgi file. The manipulation of the host argument leads to command injection. The vendor was contacted about this...

The vulnerability of the loginauth function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK CP450 router’s microprogramming system, which allows a intruder to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the loginauth function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK CP450 router’s microprogramming system is related to the issue of data being written outside the buffer in memory when processing the httphost parameter. Exploiting this vulnerability allows a malicious...

CVE-2024-7465

A vulnerability, which was classified as critical, was found in TOTOLINK CP450 4.1.0cu.747B20191224. Affected is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument httphost leads to buffer overflow. It is possible to launch the attack remotely. The exploit h...

CVE-2024-7336

A vulnerability classified as critical was found in TOTOLINK EX200 4.0.3c.7646B20201211. Affected by this vulnerability is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument httphost leads to buffer overflow. The attack can be launched remotely. The exploit...

TOTOLINK EX200 安全漏洞

The TOTOLINK EX200 is a 2.4G wireless N range extender designed to extend the coverage of existing Wi-Fi networks. A buffer overflow vulnerability exists in the TOTOLINK EX200. The vulnerability originates from the file /cgi-bin/cstecgi.cgi?action=save&setting The function getSaveConfig as...

PT-2024-5479 · Totolink · Totolink Ex200

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX200 version 4.0.3c.7646 B20201211 Description: A critical issue has been found in the getSaveConfig function of the /cgi-bin/cstecgi.cgi?action=save&setting endpoint, caused by a buffer overflow when handling the http host paramete...

PT-2024-5477 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200L version 9.3.5u.6146 B20201023 Description: The issue is caused by a buffer overflow on the stack when processing the http host parameter in the loginauth function of the /cgi-bin/cstecgi.cgi file. This can be exploited by a...

PYSEC-2024-236

Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting XSS issue. The /proxy endpoint accepts a host path segmen...

CVE-2024-35225 Jupyter Server Proxy has a reflected XSS issue in host parameter

Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting XSS issue. The /proxy endpoint accepts a host path segmen...