Command injection

Totolink routers s X5000R V9.1.0u.6118B20201102 and A7000R V9.1.0u.6115B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27005

Totolink routers s X5000R V9.1.0u.6118B20201102 and A7000R V9.1.0u.6115B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27001

Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27001

CVE-2022-27001 affects Arris TR3300 v1.0.13 and is caused by a command injection vulnerability in the DHCP hostname parameter, allowing arbitrary command execution via a crafted request. The issue is documented across multiple sources (ARRIS/TR3300, Red Hat advisory, CNVD/CNVD-like records) and i...

PT-2022-18181 · Totolink · Totolink A7000R +1

Name of the Vulnerable Software and Affected Versions: Totolink routers X5000R version 9.1.0u.6118 B20201102 Totolink routers A7000R version 9.1.0u.6115 B20201022 Description: A command injection issue was discovered in the setWanCfg function via the hostName parameter, allowing attackers to...

CVE-2022-27005: Improper Neutralization of Special Elements used in an OS Command

Totolink routers s X5000R V9.1.0u.6118B20201102 and A7000R V9.1.0u.6115B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

PT-2022-18178 · Arris · Arris Tr3300

Name of the Vulnerable Software and Affected Versions: Arris TR3300 version 1.0.13 Description: A command injection issue was found in the dhcp function via the hostname parameter, allowing attackers to execute arbitrary commands through a crafted request. Recommendations: For Arris TR3300 versio...

CVE-2022-27001: Improper Neutralization of Special Elements used in a Command

Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

Tenda G1 and G3 Command Injection Vulnerability (CNVD-2022-16176)

The Tenda G1 and G3 are routers from the Chinese company Tenda. A command injection vulnerability exists in the Tenda G1 and G3, which can be exploited to execute arbitrary commands via the hostName parameter...

CVE-2021-45987

Tenda routers G1 and G3 v15.11.0.179502CN were discovered to contain a command injection vulnerability in the function formSetNetCheckTools. This vulnerability allows attackers to execute arbitrary commands via the hostName parameter...

Command injection

Tenda routers G1 and G3 v15.11.0.179502CN were discovered to contain a command injection vulnerability in the function formSetNetCheckTools. This vulnerability allows attackers to execute arbitrary commands via the hostName parameter...

Tenda G1 and G3 操作系统命令注入漏洞

The Tenda G1 and G3 are routers from the Chinese company Tenda. A command injection vulnerability exists in the Tenda G1 and G3, which can be exploited to execute arbitrary commands via the hostName parameter...

CVE-2019-18860

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi...

CVE-2019-18860

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi...

CVE-2019-18860: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi...

IBM Spectrum Protect Plus hostname Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of IBM Spectrum Protect Plus. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Administrative Console Framework service. When parsing the hostname...

PT-2020-6769

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.5 Description The issue is related to the failure to neutralize special elements in user-input strings during the syntactic analysis of the hostname parameter. This can be exploited by a...

CVE-2019-20072

CVE-2019-20072 corresponds to a cross-site scripting vulnerability in Netis DL4323 devices, exploitable via the hostname parameter in form2Ddns.cgi used for Dynamic DNS configuration. The issue stems from insufficient input validation in the web application, enabling execution of arbitrary client...

PT-2019-16077

Name of the Vulnerable Software and Affected Versions Netis DL4323 affected versions not specified Description The issue exists due to a problem with the hostname parameter in the "form2Ddns.cgi" script, which is part of the Dynamic DNS Configuration. This allows for XSS attacks. Recommendations...

PT-2019-20260

Name of the Vulnerable Software and Affected Versions FortiGate versions 6.0.0 through 6.0.6 FortiGate versions 6.2.0 through 6.2.1 Description The issue is related to an Improper Neutralization of Input in the hostname parameter of a DHCP packet under the DHCP monitor page. This may allow an...